We use ISE to handle port security on our switches. When I see that there is a mac address being dropped by the switch it doesn't show what interface this mac is patched into.
#show mac address-table (#show mac address-table | i a4ad will show similar minus additional macs)
#show mac address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 8c60.4f04.4d42 DYNAMIC Gi1/1/1
136 0000.0c9f.f088 DYNAMIC Gi1/1/1
136 0014.3895.8cb4 DYNAMIC Gi1/0/36
136 0017.c8c5.a4ad DYNAMIC Drop
136 8c60.4f04.4842 DYNAMIC Gi1/1/1
136 8c60.4f04.4d42 DYNAMIC Gi1/1/1
.....
144 f87a.4166.33b4 DYNAMIC Gi1/1/1
Total Mac Addresses for this criterion: 28
#show mac address-table address 0017.c8c5.a4ad
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
136 0017.c8c5.a4ad DYNAMIC Drop
#show port-security address
Secure Mac Address Table
-------------------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age
(mins)
---- ----------- ---- ----- -------------
-------------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port) : 0
Max Addresses limit in System (excluding one mac per port) : 4096
What I normally do is just search the log messages for that mac address and that gives me the interface.
#show logging | i a4ad
However in this instance I am not seeing any log messages associated with this mac address so cant discover the interface. Is there a show command that will quickly show what interface this mac is associated with?
I can do #show mac address-table int g1/0/1 and repeat all the way through every interface number and that will eventually show the mac address being dropped and the interface but that is quite cumbersome especially when you have a stack made up of eight switches. I can also log into ISE and run a report but that feels like I am having to go around two sides of a triangle.
Edit. I have discovered the interface (G1/0/40) by running a report on ISE and below is the output from the interface that the device is plugged into. The switch knows what interface the mac is being learnt from, but there doesn't seem to be an easy way to find the interface out on the switch. So if I know the interface I can resolve the issue quite easily. If I don't know the interface then I have to use ISE or go through #show mac address-table int Gx/0/x for every port on the switch until I find it. ISE is not always available if I am offsite.
#show mac address-table int g1/0/40
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
136 0017.c82a.bd09 STATIC Gi1/0/40
136 0017.c8c5.a4ad DYNAMIC Drop
136 a4bb.6d75.b3d1 DYNAMIC Gi1/0/40
What will have probably happened here is the end user had got a little unmanaged 4 port switch on their desk that plugs into our Cisco switch, they have their PC a4bb.6d75.b3d1 and a printer 0017.c82a.bd09 plugged into it. Printer team has come along and swapped the printer and plugged in the new printer 0017.c8c5.a4ad to the unmanaged switch and the ISE port security has kicked off and is Dropping this new mac address. This is the behaviour we want. We don't like users plugging unmanaged switches into our Cisco network. But then when the printer team ring up to say the new printer isn't working (and the department can't discharge patients ;)) I can log onto the Cisco switch and confirm that I can see the new mac address 0017.c8c5.a4ad but I then have to either search each interface individually for the Drop-ped mac or run a report on ISE to find the interface to reset it. It seems odd if there is no show command that links a dropped mac address to an interface.
