Do hosts that violate port-security show up in the mac-address table, or is this only in the logs? What would the log entry look like that has the violating address? We're on Cisco 2960X.
Error Logs are generated such as:
%PM-4-ERR_DISABLE and %PORT_SECURITY-2-PSECURE_VIOLATION
The port status is also changed from Secure-Up to Secure-Down.
Port security learns unauthorized MAC addresses with a bit set that causes traffic to them or from them to be dropped. The show mac-address-table command displays the unauthorized MAC addresses, but does not display the state of the bit. (CSCeb76844)