Checking MAC Addresses on a Cisco Switch

You can check the MAC addresses stored by a Cisco switch by logging into the switch and issuing the command show mac address-table. The addresses are stored in a table called the bridge forwarding table or CAM table.
Switch1>show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0009.e897.d280    STATIC      CPU
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0100.0cdd.dddd    STATIC      CPU
   1    0010.db0c.7dd2    DYNAMIC     Fa0/1
   1    0018.f3a6.018a    DYNAMIC     Fa0/18
   1    00e0.1882.79a4    DYNAMIC     Fa0/12
Total Mac Addresses for this criterion: 7

Switches maintain a table of both static and dynamically learned IP addresses. Cisco switches have a number of special built-in addresses such as the 4 static address above. E.g., in the above case the first entry 0009.e897.d280 is a static entry reflecting the MAC address of the switch itself. In the above example, 3 systems are connected to the switch on ports 1, 12, and 18. Their addresses are reported as dynamic addresses.

You can view just the static or just the dynamic MAC addresses with the commands show mac address static and show mac address dynamic.

You can also view the MAC addresses using the show interfaces command, but that gives you a lot of extra information as well, so it isn't as easy to see the MAC addresses for all interfaces at a glance.

Switch1>   show interfaces
Vlan1 is up, line protocol is up
  Hardware is CPU Interface, address is 0009.e897.d280 (bia 0009.e897.d280)
  Internet address is 192.168.0.4/26
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output never, output hang never
  Last clearing of "show interface" counters never

A MAC address for the switch can be seen in line 2 of the output of the command. A lot more information is actually output than what is shown.

The show arp command will also show some MAC addresses, but only those with which the switch has had some communication at the IP level. The MAC addresses show Ethernet level communications.

Switch1>show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.0.50            0   00e0.1882.79a4  ARPA   Vlan1
Internet  192.168.0.4             -   0009.e897.d280  ARPA   Vlan1

In the example above, the 192.168.0.50 address represents the IP address of the system by which I was logged into the switch. The switch IP address was 192.168.0.4.

References:

  1. Cisco administration 101: Understanding Ethernet MAC addresses
    By: David Davis CCIE, MCSE+I, SCSA
    Date: october 12, 2006
    TechRepublic
  2. How a Cisco Switch functions on an Ethernet network
    By: David Davis, vExpert, VCP, CCIE 9369
    Date: January 7, 2009
    Petri IT Knowledgebase

Valid HTML 4.01 Transitional