7.3.7 Lab – View the Switch MAC Address Table (Answers)

 

Objectives

Part 1: Configure and Build the Network

Examine the Switch MAC Address Table in Part 2

Context / Scenario

A Layer 2 LAN switch's primary function is to transmit Ethernet frames to host devices on the local network. The switch keeps track of all visible host MAC addresses on the network and maps them to its own Ethernet switch ports. This is referred to as creating the MAC address database. When a switch gets a frame from a PC, the source and destination MAC addresses of the frame are examined. The MAC address of the source is saved and mapped to the switch port from which it originated. The target MAC address is then retrieved from the MAC address database. If the destination MAC address is known, the frame is forwarded out of the switch port that corresponds to that MAC address. If the MAC address of the frame is unknown, it is broadcast from all switch ports except the one from which it originated. It is critical to watch and understand how switches operate and how they transport data across a network. The operation of a switch has consequences for network managers, whose duty is to maintain safe and consistent network connectivity. Switches are used to connect and distribute data to computers connected to local area networks. Ethernet frames are delivered by switches to host devices identifiable by their network interface card MAC addresses.

Part 1 will walk you through creating a multi-switch architecture with a trunk connecting the two switches. Part 2 will consist of pinging different devices and seeing how the two switches construct their MAC address tables.

Cisco Catalyst 2960 switches running Cisco IOS Release 15.2(2) were utilised (lanbasek9 image). Other Cisco switches and Cisco IOS versions are also supported. Depending on the model and Cisco IOS version, the available commands and output may differ from what is shown in the labs.

Nota bene: Ensure that the switches have been wiped and are not configured for the startup. If you are uncertain, speak with your teacher.

Instructor Note: The processes for initialising and reloading devices are detailed in the Instructor Lab Manual.

Ressources Required

2 Cisco 2960 switches (with Cisco IOS Release 15.2(2) lanbasek9 image or equivalent)

2 Personal Computers (Windows with terminal emulation program, such as Tera Term)

To configure Cisco IOS devices through the console ports, use console cables.

Ethernet cables in the topology diagram

Note that the Cisco 2960 switches' Fast Ethernet interfaces are autosensing, and an Ethernet straight-through connection may be utilised between switches S1 and S2. If another Cisco switch model is used, an Ethernet crossover connection may be required.

Instructions

Part 1: Configure and Build the Network

Step 1: Connect the network in a topology-appropriate manner.

Step 2: Configure the hosts on the PCs.

Step 3: If required, initialise and reload switches.

Step 4: Configure the switch's basic settings.

a. As indicated in the topology, configure the device name.

b. Configure IP addresses in accordance with the Addressing Table.

c. Assign the console and vty passwords to cisco.

d. Assign class as the EXEC password for privileged users.

Examine the Switch MAC Address Table in Part 2

As network devices commence communication on the network, a switch acquires MAC addresses and populates the MAC address table.

Step 1: Make a note of the MAC addresses of network devices.

a. On PC-A and PC-B, open a command prompt and execute ipconfig /all.

What are the physical addresses of Ethernet adapters?

MAC Address of PC-A:

The responses will vary. In this case, the MAC address is 00-50-56-B3-27-D6.

MAC Address of the PC-B:

The responses will vary. In this case, the MAC address is 00-50-56-B3-FF-54.

a. Log into switch S1 and switch S2 through the console and issue the show interface F0/1 command on each switch.

What is the hardware address (or burned-in address [bia]) on the second line of command output?

MAC Address of S1 Fast Ethernet 0/1:

The responses will vary. According to the sample output below, the MAC address of S1 F0/1 is 0cd9.96e2.3d01.

MAC Address of S2 Fast Ethernet 0/1:

The responses will vary. According to the sample output below, the MAC address of S2 F0/1 is 0cd9.96d2.3f81.

S1# show interface f0/1
FastEthernet0/1 is up, line protocol is up (connected)
  Hardware is Fast Ethernet, address is 001a.e3cf.b883 (bia 001a.e3cf.b883)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,


S2# show interface f0/1
FastEthernet0/1 is up, line protocol is up (connected)
  Hardware is Fast Ethernet, address is 0025.83e6.9081 (bia 0025.83e6.9081)
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, 
<output omitted>

Display the switch's MAC address table in Step 2.
Log onto switch S2 through the console and inspect the MAC address table both before and after doing network connection tests with ping.

a. Connect to S2 via console and enter privileged EXEC mode.

b. In privileged EXEC mode, enter and press Enter the display mac address-table command.

S2# show mac address-table

Even though no network communication has been established across the network (i.e., there has been no usage of ping), it is feasible that the switch has picked up MAC addresses from its connection to the PC and the other switch.

Is there a record of any MAC addresses in the MAC address table?

The switch's database may include one or more MAC addresses, depending on whether or not the students used the ping command during network configuration. The switch has very certainly acquired MAC addresses through S1's F0/1 switch port. Multiple MAC addresses of hosts learned through the connection to the other switch on F0/1 will be recorded by the switch.

S2# show mac address-table
         Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
 All    0180.c200.0001    STATIC      CPU
 All    0180.c200.0002    STATIC      CPU
 All    0180.c200.0003    STATIC      CPU
 All    0180.c200.0004    STATIC      CPU
 All    0180.c200.0005    STATIC      CPU
 All    0180.c200.0006    STATIC      CPU
 All    0180.c200.0007    STATIC      CPU
 All    0180.c200.0008    STATIC      CPU
 All    0180.c200.0009    STATIC      CPU
 All    0180.c200.000a    STATIC      CPU
 All    0180.c200.000b    STATIC      CPU
 All    0180.c200.000c    STATIC      CPU
 All    0180.c200.000d    STATIC      CPU
 All    0180.c200.000e    STATIC      CPU
 All    0180.c200.000f    STATIC      CPU
 All    0180.c200.0010    STATIC      CPU
 All    ffff.ffff.ffff    STATIC      CPU
   1    001a.e3cf.b883    DYNAMIC     Fa0/1
Total Mac Addresses for this criterion: 21
What MAC addresses is the table storing? They are mapped to which switch ports and whose devices. Ignore CPU-mapped MAC addresses.

Multiple MAC addresses may be stored in the MAC address database, particularly those obtained through S1's F0/1 switch port. The MAC addresses of S1 F0/1 and PC-A are mapped to S2 F0/1 in the sample output above.

If you had not previously documented the MAC addresses of network devices in Step 1, how could you determine which devices the MAC addresses belong to based only on the results of the show mac address-table command? Is it applicable in all circumstances?

The show mac address-table command returns the port on which the MAC address was discovered. This typically indicates which network device the MAC address belongs to, unless when numerous MAC addresses are linked with the same port. This occurs when switches are linked to other switches and record all of the MAC addresses associated with the other switch's devices.

Step 3: Delete the S2 MAC address database and re-display it.

a. In privileged EXEC mode, enter and press Enter the clear mac address-table dynamic command.

S2# clear mac address-table dynamic

b. Type the display mac address-table command once more quickly.

Is there a MAC address table entry for VLAN 1? Is there a list of more MAC addresses?

No. Most likely, the student will notice that the MAC address for the other switch's F0/1 switch port was rapidly reinserted into the MAC address database.
S2# show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
 All    0180.c200.0001    STATIC      CPU
 All    0180.c200.0002    STATIC      CPU
 All    0180.c200.0003    STATIC      CPU
 All    0180.c200.0004    STATIC      CPU
 All    0180.c200.0005    STATIC      CPU
 All    0180.c200.0006    STATIC      CPU
 All    0180.c200.0007    STATIC      CPU
 All    0180.c200.0008    STATIC      CPU
 All    0180.c200.0009    STATIC      CPU
 All    0180.c200.000a    STATIC      CPU
 All    0180.c200.000b    STATIC      CPU
 All    0180.c200.000c    STATIC      CPU
 All    0180.c200.000d    STATIC      CPU
 All    0180.c200.000e    STATIC      CPU
 All    0180.c200.000f    STATIC      CPU
 All    0180.c200.0010    STATIC      CPU
 All    ffff.ffff.ffff    STATIC      CPU
   1    001a.e3cf.b883    DYNAMIC     Fa0/1
Total Mac Addresses for this criterion: 21
Wait ten seconds, then enter the display mac address-table command. Is the MAC address database updated with new addresses?

The responses will vary. The table may include other MAC addresses.

Ping the network devices from PC-B and see the switch MAC address table.

a. Open a command prompt on PC-B and enter arp -a.

How many device IP-to-MAC address pairings have been learnt via ARP, excluding multicast or broadcast addresses?

The responses will vary. The ARP cache may include no entries or may provide a mapping of the gateway's IP address to MAC address.
C:\Users\PC-B> arp –a

Interface: 192.168.1.2 --- 0x6
Internet Address      Physical Address      Type
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.252           01-00-5e-00-00-fc     static
  255.255.255.255       ff-ff-ff-ff-ff-ff     static
b. Ping PC-A, S1, and S2 from the PC-B command prompt.

Were all devices able to respond successfully? If not, make sure your cabling and IP setups are correct.

If the network has been properly cabled and setup, the response should be yes.

c. Connect to S2 through a console connection and run the show mac address-table command.

Has the switch updated the MAC address database with extra MAC addresses? If so, what addresses and devices are involved?

There may be just one more MAC address mapping in the database, most likely PC-MAC A's address.
S2# show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
 All    0180.c200.0001    STATIC      CPU
 All    0180.c200.0002    STATIC      CPU
 All    0180.c200.0003    STATIC      CPU
 All    0180.c200.0004    STATIC      CPU
 All    0180.c200.0005    STATIC      CPU
 All    0180.c200.0006    STATIC      CPU
 All    0180.c200.0007    STATIC      CPU
 All    0180.c200.0008    STATIC      CPU
 All    0180.c200.0009    STATIC      CPU
 All    0180.c200.000a    STATIC      CPU
 All    0180.c200.000b    STATIC      CPU
 All    0180.c200.000c    STATIC      CPU
 All    0180.c200.000d    STATIC      CPU
 All    0180.c200.000e    STATIC      CPU
 All    0180.c200.000f    STATIC      CPU
 All    0180.c200.0010    STATIC      CPU
 All    ffff.ffff.ffff    STATIC      CPU
   1    001a.e3cf.b883    DYNAMIC     Fa0/1
   1    001a.e3cf.b8c0    DYNAMIC     Fa0/1
   1    0050.56b3.27d6    DYNAMIC     Fa0/1
   1    0050.56b3.ff54    DYNAMIC     Fa0/18
Total Mac Addresses for this criterion: 24
Open a command prompt on PC-B and retype arp -a.

Is there more space in the PC-B ARP cache for all network devices that delivered pings?

Although responses may vary, the ARP cache on PC-B should include more records.
C:\Users\PC-B> arp –a

Interface: 192.168.1.2 --- 0x6
  Internet Address      Physical Address      Type
  192.168.1.1           00-50-56-b3-27-d6     dynamic
  192.168.1.11          00-1a-e3-cf-b8-c0     dynamic
  192.168.1.12          00-25-83-e6-90-c0     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.252           01-00-5e-00-00-fc     static
  239.255.255.250       01-00-5e-7f-ff-fa     static

Reflection Question
On Ethernet networks, data is delivered to devices by their MAC addresses. For this to happen, switches and PCs dynamically build ARP caches and MAC address tables. With only a few computers on the network, this process seems fairly easy. What might be some of the challenges on larger networks?
ARP broadcasts could cause broadcast storms. Because ARP and switch MAC tables do not authenticate or validate the IP addresses to MAC addresses it would be easy to spoof a device on the network.
Device Configs
Switch S1
S1# show running-config
Building configuration...

version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname S1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$lRkm$DFlxhlhb6FCHl4J.ux4Fb/
!
no aaa new-model
system mtu routing 1500
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 ip address 192.168.1.11 255.255.255.0
!
ip http server
ip http secure-server
!
line con 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
end

Switch S2
S2#show running-config
Building configuration...

version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname S2
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$lRkm$DFlxhlhb6FCHl4J.ux4Fb/
!
no aaa new-model
system mtu routing 1500
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 ip address 192.168.1.12 255.255.255.0
!
ip http server
ip http secure-server
!
line con 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
end