#Cisco switch show mac address table software#

There is another very useful way to filter MAC addresses. Setting MAC address filtering with sticky command %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address f02d.3f4e.2dcc on port GigabitEthernet0/1.Īs you can see from the log message above, a device with MAC address f02d.3f4e.2dcc violated the port-security and interface went into err-disabled state. %PM-4-ERR_DISABLE: psecure-violation error detected on Gi0/1, putting Gi0/1 in err-disable state You will see the message below if there would be any violation. TestSwitch(config-if)#switchport port-security mac-address Īny device having different MAC address than this will violate the rule and the interface will go to err-disabled state. In the following example I configured port security so it only allows MAC address to connect to the specific port of the switch. Setting MAC address filtering per portīesides setting a maximum limit on the number of MAC addresses, you can also use port security to filter MAC addresses. If this interface receives any more MAC addresses it will go to err-disabled state. Now, interface g0/1 is allowed to learn only one MAC address. TestSwitch(config-if)#switchport port-security maximum 1 TestSwitch(config-if)#switchport port-security TestSwitch(config-if)#switchport mode access

#Cisco switch show mac address table software#

I will be using Cisco 3560 Switch version 15.0, for this tutorial.Ĭisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE7, RELEASE SOFTWARE (fc1) Setting MAC address limits per portīelow is an example of Port Security where only one MAC address is allowed on interface g0/1. Let’s now see the basic port-security configuration on Cisco switches. It’s called Port Security and you can use it to limit the number of MAC addresses per interface or even to specify which MAC address can connect to each physical port of the switch. The solution to this kind of attacks (and also to other Layer 2 attacks) is easy and simple. This means that the attacker can capture the traffic from connected devices. The switch will learn these MAC addresses and once the switch reaches its MAC address learning limit it will start flooding all the traffic to all of its ports (i.e it will start behaving like a hub). In MAC-flooding, an attacker can connect a laptop into an empty Switch port or empty RJ45 wall socket, and he can use hacking tools to generate millions of Ethernet frames with fake source MAC addresses and send them to the switch interface. This means that the switch can play an important role in network security since it’s the entry-point of the network.įor example, port- security on Cisco switches can be used to stop MAC-flooding attacks or prevent non-authorized hosts to connect to the switch. One of the best practices in network security is to try and stop security threats from the entry-point of a LAN network.