MAC Address table brings several different mac addresses for one port

cisco-catalystsnmp

i have a CAT2960 switch from which i am polling mac address tables the cable from the ethernet socket to the switch is placed in port 24, and i have 2 more pc ethernet cables in port 3 and port 7. when i use the command

[sosytee@20090886~]$ snmpbulkwalk -v 2c -c public@1 -OXsq 10.0.0.98 \
.1.3.6.1.2.1.17.4.3.1.2

I get so many different mac addresses for port 24, here is an extract of what i get

dot1dTpFdbPort[0:6:53:fe:39:e0] 24 
 dot1dTpFdbPort[0:1d:a1:cd:53:46] 24 
 dot1dTpFdbPort[0:30:1b:bc:a7:d7] 3 
 dot1dTpFdbPort[0:80:c8:0:0:0] 7 
 dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 24 
 dot1dTpFdbPort[80:ee:73:2f:b:40] 24

I would want to know how i should interpret this because i was assuming each port presents one mac address. Or is it that the switch has many mac addresses.

Best Answer

I think that you have another switch or hub connected to port 24 of your 2960, and there are 4 hosts connected to that switch/hub.

Related Solutions

Cisco – How to infer 2960S switch base ethernet MAC Address

Is there a reliable way to infer the switch "Base ethernet MAC Address" from receiving such a CDP interface MAC Address, so that I can use that "Base ethernet MAC Address" as a globally unique identifier for the switch device equipment on the network?

You can't determine the base ethernet mac from CDP without guessing or assumptions about how Cisco behaves today (as well as future behavior). On the other hand, if all you want is a unique identifier, use the Chassis serial number; however, that would require polling the CDP source for entPhysicalSerialNum... a small price to eliminate guesswork.

entPhysicalSerialNum has the added bonus of working across many of Cisco's current platforms.

Sample SNMP walk of entPhysicalSerialNum:

[mpenning@tsunami ~]$ snmpbulkwalk -OXsq -v 2c -c ciscoro -m ENTITY-MIB \
  172.16.1.200 entPhysicalDescr
entPhysicalDescr[1] 2650 chassis
entPhysicalDescr[2] 2600 Chassis Slot
entPhysicalDescr[3] C2600 Mainboard
entPhysicalDescr[4] 2600 DaughterCard Slot
entPhysicalDescr[5] 2600 DaughterCard Slot
entPhysicalDescr[6] AIM Container Slot 0
entPhysicalDescr[7] 2600 Chassis Slot
entPhysicalDescr[8] One port Fastethernet TX
entPhysicalDescr[9] AmdFE
entPhysicalDescr[10] AmdFE
[mpenning@tsunami ~]$ snmpbulkwalk -OXsq -v 2c -c ciscoro -m ENTITY-MIB \
  172.16.1.200 entPhysicalSerialNum
entPhysicalSerialNum[1] JAB05290Z8Q
entPhysicalSerialNum[2]
entPhysicalSerialNum[3] yyyyyyyyyyy
entPhysicalSerialNum[4]
entPhysicalSerialNum[5]
entPhysicalSerialNum[6]
entPhysicalSerialNum[7]
entPhysicalSerialNum[8] 25809045
entPhysicalSerialNum[9]
entPhysicalSerialNum[10]
[mpenning@tsunami ~]$

SNMPWALK Output – Translating to Human-Readable Format

my own solution comes out in the form of

iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25

... do the other numbers represent a MAC address and if so, why are they different from the give solution?

First, I apologize for not including this dependency...

The MIB tables you're polling are indexed by a value. In this case, you're polling dot1dTpFdbPort (which shows up as iso.3.6.1.2.1.17.4.3.1.2, if you don't have the BRIDGE-MIB loaded). That OID is indexed by a mac-address. Therefore, 0.20.42.49.139.235 is the mac-address in dotted-decimal format...

To see the results you expect, you need to get the v2 mibs from Cisco's FTP site:

mkdir /usr/share/snmp/mibs/cisco (as root)
cd /usr/share/snmp/mibs/cisco
Copy v2.tar.gz that you just downloaded to /usr/share/snmp/mibs/cisco/v2.tar.gz
tar xvfz v2.tar.gz
Edit /etc/snmp/snmp.conf and make this the first line in the file: mibdirs +/usr/share/snmp/mibs/cisco

Assumptions:

You're using NET-SNMP libraries to poll
Your NET-SNMP default MIBs are loaded in /usr/share/snmp/mibs/
Your NET-SNMP configuration is in /etc/snmp/snmp.conf

Best Answer

Related Solutions

Cisco – How to infer 2960S switch base ethernet MAC Address

SNMPWALK Output – Translating to Human-Readable Format

Related Topic