Cisco question regarding static MAC addresses on switch

Question

CCENT student here and looking for some confirmation. Working on the ICND1 Odom book with a 2950 switch. I have a quick question regarding static MAC addresses, as per this passage:

Here is my output for show mac address-table command:

My questions are:

1. Am I correct in thinking that static MAC address are the mac addresses of the switch itself?
2. Why are there 4 static mac addresses?
3. In the orange highlighted part of the textbook passage, what is meant by static mac addresses configured by port security feature?
4. For the dynamic mac addresses (interface 1 and 24, which I have connected out to two other switches), why are there two, and not one, mac addresses entries learned per port?

I appreciate any insight. :)

Answer 1

1. The MAC address table relates the source MAC addresses for frames which have come into a port with the port. This lets the switch know to which port it should send frames with that destination MAC address. The MAC addresses are from hosts connected to the ports. The CPU port is the switch itself.
2. Static MAC addresses in the MAC address table were manually configured. The dynamic entries in the MAC address table will time out after a while. The table is dynamic and when a frame with a source MAC address comes into a switch the table is updated to reflect that the device with that MAC address is out that port. There can only be a single port for a MAC address. Manually putting an entry in the table bypasses all of that. The switch will automtically have static entries for itself.
3. Only allowing traffic destined to a MAC address through a manually configured port will help prevent ARP spoofing problems.
4. You can have frames from many different hosts (MAC addresses) come into a single port. This is the case when a hub or switch with many hosts is connected to a switch port.

Answer 2

Question 1:

Am I correct in thinking that static MAC address are the mac addresses of the switch itself?

Yes, the first four MAC addresses belong to the switch itself.

Question 2:

Why are there 4 static mac addresses?

As per this link,

For L2 switches, there are mac addresses for different functions (to be able to communicate (when we want to telnet, ping or do snmp to the switch) and spanning tree (to form the bridge ID). On some manufactures switches, they use 1 mac address for all functions, Cisco does not. On the 4/5/6x00 devices, there are 1024 mac addresses assigned to the upervisor (1 or more for the switch, 1000 for spanning tree (PVST, each instance has its ' own mac address)).

Question 3:

In the orange highlighted part of the textbook passage, what is meant by static mac addresses configured by port security feature?

You can use port security to define which MAC addresses should be seen on specific ports.

Question 4:

For the dynamic mac addresses (interface 1 and 24, which I have connected out to two other switches), why are there two, and not one, mac addresses entries learned per port?

Because it's a Layer 2 network. MAC addresses will be learned on every layer 2 device between the source and destination devices.

If you're interested in finding out which MAC address belongs to which device, you can look up the OUI of MAC addresses in your output. For example, I can see you've got a few Cisco, Linksys and Netgear devices.