i have a CAT2960 switch from which i am polling mac address tables the cable from the ethernet socket to the switch is placed in port 24, and i have 2 more pc ethernet cables in port 3 and port 7. when i use the command

[sosytee@20090886~]$ snmpbulkwalk -v 2c -c public@1 -OXsq \ .

I get so many different mac addresses for port 24, here is an extract of what i get

dot1dTpFdbPort[0:6:53:fe:39:e0] 24 
 dot1dTpFdbPort[0:1d:a1:cd:53:46] 24 
 dot1dTpFdbPort[0:30:1b:bc:a7:d7] 3 
 dot1dTpFdbPort[0:80:c8:0:0:0] 7 
 dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 24 
 dot1dTpFdbPort[80:ee:73:2f:b:40] 24

I would want to know how i should interpret this because i was assuming each port presents one mac address. Or is it that the switch has many mac addresses.

  • 1
    Why do you think you only have one device behind port 24? It's perfectly normal to have many devices behind port.
    – ytti
    Sep 6, 2013 at 8:51
  • the reason i assumed so is that when i poll for arp tables, i dont get as many mac addresses
    – sosytee
    Sep 6, 2013 at 8:53
  • 5
    Usually port 24 is an uplink leading to some other switch so it would be natural to have multiple MAC addresses there. If you poll for ARP you only get those that the switch has learned if it has an IP interface which is usually for MGMT. Don't confuse ARP and MAC. Normally you would have more MACs than entries in ARP cache unless it's a L3 gateway.
    – Daniel Dib
    Sep 6, 2013 at 9:11
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 3, 2021 at 21:30

4 Answers 4


I think that you have another switch or hub connected to port 24 of your 2960, and there are 4 hosts connected to that switch/hub.

  • Use this site with the MAC address you have to help you find out what is connected macvendorlookup.com There are many sites like this, just enter "mac vendor lookup" in Google. Note: it's not Magical, but it will help you trace what is connected there: 00:06:53:fe:39:e0 = Cisco 00:1d:a1:cd:53:46 = Cisco There is at least another Cisco device connected to Port 24, and through it: 38:ea:a7:6d:2e:8e = HP Device (Printer? Server?) and 80:ee:73:2f:b:40 = Shuttle (Something with a NIC made by Shuttle - PC?) Sep 9, 2013 at 15:04

You are polling a table with the known MAC addresses. It seems that your switch is connected to another one on port 24 so all MAC's that come from the other switch are seen on port 24.

You can find a description of the SNMP MIB here : dot1dTpFdbStatus

"Either the value '0', or the port number of the port on which a frame having a source address equal to the value of the corresponding instance of dot1dTpFdbAddress has been seen. A value of '0' indicates that the port number has not been learned but that the bridge does have some forwarding/filtering information about this address (e.g. in the dot1dStaticTable). Implementors are encouraged to assign the port value to this object whenever it is learned even for addresses for which the corresponding value of dot1dTpFdbStatus is not learned(3)."


As others on here have stated, you will find many MAC addresses coming from a single port if there is another switch off that port with other hosts connected to it. On a Cisco switch you can view the CAM table (MAC address table) by issuing the "show mac address-table" command. In this output of this table, if your switch has a trunk to another switch that has hosts connected to it, you will see in your MAC address table that number of clients being learned from a single switchport, or, your trunk to the other switch.

This is just the result of switching -- managing layer 2 data links.


Is port 24 a trunk or acccess port? General protocol is to use 24 as the trunk link on a 24 port switch and allow all or any necessary vlans to traverse the link. This in itself would create multiple mac address entries.

This should prove your theory that i=this is a false positive...do a show cdp neighbors....or lldp neighbor then see what the the output is, it might just be different.Also show interface trunk on gi 0/24 , or show interfaces switchport which is going to tell you a lot more data such as the vlans in use on the ports in question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.