3

We use ISE to handle port security on our switches. When I see that there is a mac address being dropped by the switch it doesn't show what interface this mac is patched into.

#show mac address-table (#show mac address-table | i a4ad will show similar minus additional macs)

#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    8c60.4f04.4d42    DYNAMIC     Gi1/1/1
 136    0000.0c9f.f088    DYNAMIC     Gi1/1/1
 136    0014.3895.8cb4    DYNAMIC     Gi1/0/36
 136    0017.c8c5.a4ad    DYNAMIC     Drop
 136    8c60.4f04.4842    DYNAMIC     Gi1/1/1
 136    8c60.4f04.4d42    DYNAMIC     Gi1/1/1
.....
 144    f87a.4166.33b4    DYNAMIC     Gi1/1/1
Total Mac Addresses for this criterion: 28


#show mac address-table address 0017.c8c5.a4ad
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 136    0017.c8c5.a4ad    DYNAMIC     Drop


#show port-security address
               Secure Mac Address Table
-------------------------------------------------------------------------------
Vlan    Mac Address       Type                          Ports   Remaining Age
                                                                   (mins)
----    -----------       ----                          -----   -------------
-------------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 4096

What I normally do is just search the log messages for that mac address and that gives me the interface.

#show logging | i a4ad

However in this instance I am not seeing any log messages associated with this mac address so cant discover the interface. Is there a show command that will quickly show what interface this mac is associated with?

I can do #show mac address-table int g1/0/1 and repeat all the way through every interface number and that will eventually show the mac address being dropped and the interface but that is quite cumbersome especially when you have a stack made up of eight switches. I can also log into ISE and run a report but that feels like I am having to go around two sides of a triangle.

Edit. I have discovered the interface (G1/0/40) by running a report on ISE and below is the output from the interface that the device is plugged into. The switch knows what interface the mac is being learnt from, but there doesn't seem to be an easy way to find the interface out on the switch. So if I know the interface I can resolve the issue quite easily. If I don't know the interface then I have to use ISE or go through #show mac address-table int Gx/0/x for every port on the switch until I find it. ISE is not always available if I am offsite.

#show mac address-table int g1/0/40
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 136    0017.c82a.bd09    STATIC      Gi1/0/40
 136    0017.c8c5.a4ad    DYNAMIC     Drop
 136    a4bb.6d75.b3d1    DYNAMIC     Gi1/0/40

What will have probably happened here is the end user had got a little unmanaged 4 port switch on their desk that plugs into our Cisco switch, they have their PC a4bb.6d75.b3d1 and a printer 0017.c82a.bd09 plugged into it. Printer team has come along and swapped the printer and plugged in the new printer 0017.c8c5.a4ad to the unmanaged switch and the ISE port security has kicked off and is Dropping this new mac address. This is the behaviour we want. We don't like users plugging unmanaged switches into our Cisco network. But then when the printer team ring up to say the new printer isn't working (and the department can't discharge patients ;)) I can log onto the Cisco switch and confirm that I can see the new mac address 0017.c8c5.a4ad but I then have to either search each interface individually for the Drop-ped mac or run a report on ISE to find the interface to reset it. It seems odd if there is no show command that links a dropped mac address to an interface.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    Oct 7, 2022 at 21:00

2 Answers 2

2

Using this tclsh script you can find it more easily:

foreach prt { gi1/1/1 gi1/1/2 ... } show mac address table int $prt }
1
  • Thank you for this, the actual syntax has brackets around the last bit } { show mac address-table interface $prt }. Sep 16, 2022 at 7:29
2

show mac address-table address <address> would work, or if you don't know the exact mac address, just show mac address-table | inc <part>.

3
  • In both those instances it doesnt show the interface, it just shows Drop Sep 13, 2022 at 14:07
  • Does show port-security address give you more information?
    – Teun Vink
    Sep 13, 2022 at 14:33
  • I tried that, it is blank Sep 13, 2022 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.