MAC Address table brings several different mac addresses for one port

Question

i have a CAT2960 switch from which i am polling mac address tables the cable from the ethernet socket to the switch is placed in port 24, and i have 2 more pc ethernet cables in port 3 and port 7. when i use the command

[sosytee@20090886~]$ snmpbulkwalk -v 2c -c public@1 -OXsq 10.0.0.98 \ .1.3.6.1.2.1.17.4.3.1.2

I get so many different mac addresses for port 24, here is an extract of what i get

dot1dTpFdbPort[0:6:53:fe:39:e0] 24 
 dot1dTpFdbPort[0:1d:a1:cd:53:46] 24 
 dot1dTpFdbPort[0:30:1b:bc:a7:d7] 3 
 dot1dTpFdbPort[0:80:c8:0:0:0] 7 
 dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 24 
 dot1dTpFdbPort[80:ee:73:2f:b:40] 24

I would want to know how i should interpret this because i was assuming each port presents one mac address. Or is it that the switch has many mac addresses.

Answer 1

I think that you have another switch or hub connected to port 24 of your 2960, and there are 4 hosts connected to that switch/hub.

Answer 2

You are polling a table with the known MAC addresses. It seems that your switch is connected to another one on port 24 so all MAC's that come from the other switch are seen on port 24.

You can find a description of the SNMP MIB here : dot1dTpFdbStatus

"Either the value '0', or the port number of the port on which a frame having a source address equal to the value of the corresponding instance of dot1dTpFdbAddress has been seen. A value of '0' indicates that the port number has not been learned but that the bridge does have some forwarding/filtering information about this address (e.g. in the dot1dStaticTable). Implementors are encouraged to assign the port value to this object whenever it is learned even for addresses for which the corresponding value of dot1dTpFdbStatus is not learned(3)."

Answer 3

As others on here have stated, you will find many MAC addresses coming from a single port if there is another switch off that port with other hosts connected to it. On a Cisco switch you can view the CAM table (MAC address table) by issuing the "show mac address-table" command. In this output of this table, if your switch has a trunk to another switch that has hosts connected to it, you will see in your MAC address table that number of clients being learned from a single switchport, or, your trunk to the other switch.

This is just the result of switching -- managing layer 2 data links.

Answer 4

Is port 24 a trunk or acccess port? General protocol is to use 24 as the trunk link on a 24 port switch and allow all or any necessary vlans to traverse the link. This in itself would create multiple mac address entries.

This should prove your theory that i=this is a false positive...do a show cdp neighbors....or lldp neighbor then see what the the output is, it might just be different.Also show interface trunk on gi 0/24 , or show interfaces switchport which is going to tell you a lot more data such as the vlans in use on the ports in question.