Static MAC Address Table Entry

Normally your switch will automatically learn MAC addresses and fill its MAC address table (CAM table) by looking at the source MAC address of incoming frames and flooding frames if it doesn’t know where to forward the frame.

This process is vulnerable to layer 2 MAC address spoofing attacks where an attacker spoofs a certain MAC address to change entries in the MAC address table. A really simple method to deal with this issue is to manually configure entries in the MAC address table, a static entry will always overrule dynamic entries. You can either specify the interface where the MAC address is located or tell the switch to drop the traffic.

Let’s look at an example!

R1 SW1 Static MAC Entry

To demonstrate this we only require two devices. A router to generate some traffic and a switch to look at (and configure) the MAC address table. Here’s the configuration:

R1(config)#interface fastEthernet 0/0
R1(config-if)#no shutdown
R1(config-if)#ip address
SW1(config)#interface vlan 1
SW1(config-if)#no shutdown
SW1(config-if)#ip address

We’ll do a quick ping to generate some traffic so SW1 can learn about the mac address of R1’s FastEthernet 0/0 interface:


Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms

Let’s take a look at the MAC address table:

SW1#show mac address-table dynamic vlan 1
          Mac Address Table

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    001d.a18b.36d0    DYNAMIC     Fa0/1
Total Mac Addresses for this criterion: 1

Here’s the MAC address of R1, learned dynamically. Let’s turn this into a static entry:

SW1(config)#mac address-table static 001d.a18b.36d0 vlan 1 interface fastEthernet 0/1

Use the mac address-table static command to create a static entry. Here’s what the MAC address table looks like now:

SW1#show mac address-table static | include Fa0/1
   1    001d.a18b.36d0    STATIC      Fa0/1

There it is, a static entry. No way to overrule this unless you have access to our switch. This prevents us from moving R1 to another interface on SW1 unless we change the static entry. Like I mentioned before we can also change a static entry so it will drop all traffic. Here’s how to do it:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You’ve Ever Spent on Your Cisco Career!
  • Full Access to our 739 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

536 Sign Ups in the last 30 days

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: ,

Forum Replies

  1. Hello Jigar.

    I tried to replicate what you describe here on a Cisco 3560 production switch. I have device with a MAC address and I have statically assigned the MAC address to Gi0/4. I plug the device into interface Gi0/5 but the device has no connectivity. Looking at the MAC address table, I see that the switch has not learned the statically bound MAC address (to interface Gi0/4) on interface Gi0/5. Here is a sample of my output after implementing the static MAC allocation and changing the connection to port Gi 0/5 (the Xs and Ys were added by me for confid

    ... Continue reading in our forum

  2. Hello Wisam.

    I don’t know of a way to do it in one command, but you can do the following:

    Step 1: To determine the MAC address of the device connected to Fa0/10, use the following command:

    Switch#show mac address-table | include fa0/10

    This will give you a list of MAC addresses associated with that port. If you only have one device on this port, only one MAC address will show up.

    Step 2: To determine the IP address associated with the MAC address you found, use the following command:

    Switch#show arp | include XXXX.YYYY.ZZZZ

    where XXXX.YYYY.ZZZZ is the MAC add

    ... Continue reading in our forum

  3. @Ananth On a LAN, we use Ethernet and each device has a built in MAC address. You don’t have to configure the MAC address yourself. Let’s say you have two computers connected to a switch. These computers will have a MAC address, it comes with their network cards.

    These computers however don’t communicate directly with Ethernet, they use IP instead. You’ll have to configure an IP address on each computer and it has to be in the same subnet. When ComputerA wants to send something to ComputerB, it will create an IP packet with its own IP address as the source and

    ... Continue reading in our forum

  4. Hello Azm

    The MAC address you see in the output of the show interface command is the MAC address of the switch’s physical port. Conversely the MAC addresses that populate the MAC Address Table are those of the devices connected to the switch. Cisco switches are designed to have a se

    ... Continue reading in our forum

  5. Hello Sameer

    A switch can have transverse traffic, and traffic that is sent or destined to the switch itself.

    Transverse traffic is traffic with source and destination MAC addresses that don’t belong to the switch. In other words, this is traffic that comes from and goes to a host other than the switch itself. This is the vast majority of traffic that a switch will service, and this fulfills the fundamental function of the switch. This can generally be called user traffic, or data plane traffic. Transverse traffic automatically creates entries in the MAC ad

    ... Continue reading in our forum

38 more replies! Ask a question or join the discussion by visiting our Community Forum