Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

mystery MAC address

I have a MAC address that sends out random ARP requests. I know the MAC address so I did 'show mac-address-table' to find the port(fa0/8). I found the port but the weird thing is that there are 2 MAC addresses listed for that port. I figured it was a bad NIC or software so I replaced the NIC. The MAC address then appeared on another port (fa0/5). Again, there was only one device connected on that interface but there were still 2 MAC addresses listed for that port in 'show mac-address-table.' For giggles I switched the NIC on that device then the ghost MAC address appeared on a different port(fa0/12) when I issued 'show mac-address-table' What in the world is going on? I am completely stumped as to why this MAC address won't go away.



Re: mystery MAC address


it seems like if you have a virus and he is spreading you devices one after one,you know that there is a lot of tools that can saturate your cam table by randamely mac-addresses the purpose of such tools is make the mac-address-table full so the switch after that start flooding traffic to every port like a stupid hub, and this is what the tool is looking for at that stage he can start sniffing your network ;-)

soooo , clean out the device from thevirus if so, or just implement a simple layer 2 security by limiting the number of mac that may appear from a port to 1 and see again if it resolves, may be the port will go in errdisable if that mac try to appear!!!!


please do rate if it clarify


Re: mystery MAC address

What are the MAc addresses?

Post 'em both.



New Member

Re: mystery MAC address

The "ghost" MAC address is: 0010.dcf4.326c. The MAC address that is actually connected to that port is: 000c.7680.0fbc.

CreatePlease to create content