Do hosts that violate port-security show up in the mac-address table, or is this only in the logs? What would the log entry look like that has the violating address? We're on Cisco 2960X.
I'm using "protect" mode, but I'm assuming that it's the same for all options.– YanzzeeOct 26, 2017 at 16:39
Error Logs are generated such as:
%PM-4-ERR_DISABLE and %PORT_SECURITY-2-PSECURE_VIOLATION
The port status is also changed from Secure-Up to Secure-Down.
Port security learns unauthorized MAC addresses with a bit set that causes traffic to them or from them to be dropped. The show mac-address-table command displays the unauthorized MAC addresses, but does not display the state of the bit. (CSCeb76844)
So I could just show mac address-table on the ports with port security and still see any extra addresses, right?– YanzzeeOct 26, 2017 at 19:36