MAC Address table --> "system" type entries

alex_ciobanu · ‎07-09-2012

Hello,

Maybe someone could give me a definition or explanation of the mac-address table entries of "system" type ?

I find on many switches many entries with the broadcast address ffff.ffff.ffff defined by the system.

show mac address-table interface Gi1/16

Multicast Entries

vlan mac address type ports

-------+---------------+-------+--------------------------------------------

41 ffff.ffff.ffff system Gi1/16,Gi1/23,Gi1/24,Gi3/7,Gi3/11,Gi3/16

Gi3/20,Gi3/23,Gi3/29,Gi3/47,Gi4/12,Gi4/13

Gi4/14,Gi4/22,Gi4/47,Gi7/23,Gi7/45,Gi7/47

Gi8/5,Gi8/6,Po6

Thanks !

Peter Paluch · ‎07-09-2012

Hello Alex,

In my understanding, these entries are placed into the MAC address table to make sure that certain multicast and broadcast frames are (also) delivered to the CPU of the switch. Otherwise, broadcasts and specific multicasts (think CDP, VTP, STP and many more) would be simply switched through the switch without being processed by its CPU and in turn, the IOS. If you have a look at the show mac address-table without the interface specification, you will see that these specific multicast and broadcast MAC addresses have "CPU" as their outgoing interface.

Best regards,

Peter

alex_ciobanu · ‎07-09-2012

Ok, but the STP frames are sent to the MAC address of 01-80-C2-00-00-00, and CDP, VTP, DISL, PAgP, and DTP: 01-00-0C-CC-CC-CC, not to broadcast addresses.

And also, you are stating that all the broadcast frames are processed in software, and not in hardware ?

Thanks !

Peter Paluch · ‎07-09-2012

Hi Alex,

Ok, but the STP frames are sent to the MAC address of   01-80-C2-00-00-00, and CDP, VTP, DISL, PAgP, and DTP: 01-00-0C-CC-CC-CC,  not to broadcast addresses.

Correct. And they are also put into the MAC address table:

Switch# show mac address-table

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

All 0100.0ccc.cccc STATIC CPU

All 0100.0ccc.cccd STATIC CPU

All 0180.c200.0000 STATIC CPU

All 0180.c200.0001 STATIC CPU

All 0180.c200.0002 STATIC CPU

All 0180.c200.0003 STATIC CPU

All 0180.c200.0004 STATIC CPU

All 0180.c200.0005 STATIC CPU

All 0180.c200.0006 STATIC CPU

All 0180.c200.0007 STATIC CPU

All 0180.c200.0008 STATIC CPU

All 0180.c200.0009 STATIC CPU

All 0180.c200.000a STATIC CPU

All 0180.c200.000b STATIC CPU

All 0180.c200.000c STATIC CPU

All 0180.c200.000d STATIC CPU

All 0180.c200.000e STATIC CPU

All 0180.c200.000f STATIC CPU

All 0180.c200.0010 STATIC CPU

All ffff.ffff.ffff STATIC CPU

And also, you are stating that all the broadcast frames are processed in software, and not in hardware ?

Thanks !

Well, somebody from Cisco should give a definitive answer here but as far as my understanding goes, while the broadcasts/multicasts are not replicated by CPU, they are - at least for selected multicast/broadcast MAC addresses - delivered to the CPU together with being flooded through appropriate switchports. At least that is what the output of the show mac address-table tells me.

By the way, is what you originally posted really the output of the show mac address-table interface command? I've tried to replicate that on my 3560 but the format of the output was quite different.

Best regards,

Peter

alex_ciobanu · ‎07-09-2012

I got the output from a WS-C4510R-E switch, and the nice part is that I don't see the CPU entries at all in the mac address table. Probably its something related to this model only.

Funny part is that I try to see on a 6500 switch and I do not see anything.

xxxxxx# show mac address-table | inc CPU

xxxxxx# show mac address-table | inc system

xxxxxxx# show mac address-table | inc fff

xxxxxx#

On WS-C3550-48-SMI I see only the CPU entries, without the ffff.

On WS-C3560-24TS the same...

2950 the same, only CPU.

Anyway I think it differs from model to model the way the mac address table is designed for 'view'. Until now I only saw 4500 that has both fff entries and CPU entries in the mac address table.

hpsisupport · ‎12-12-2018

https://en.wikipedia.org/wiki/Multicast_address#cite_note-15

https://support.huawei.com/hedex/pages/EDOC100010596830008125/05/EDOC100010596830008125/05/resources/message/cd_feature_lldp_message_format.html

http://www.ieee802.org/1/files/public/docs2002/lldp-protocol-02.pdf

https://learningnetwork.cisco.com/thread/38323

https://learningnetwork.cisco.com/thread/91091

https://learningnetwork.cisco.com/thread/10473

https://learningnetwork.cisco.com/thread/9625

All 0100.0ccc.cccc STATIC CPU This MAC is used for L2 protocols such has CDP, VTP, DISL, PAgP, , UDLD (https://quickview.cloudapps.cisco.com/quickview/bug/CSCsw80664)
All 0100.0ccc.cccd STATIC CPU (SSTP BPDU) for native VLAN / PVST+ native VLAN is send a second time tunneled over IEEE 802.1q using special multicast MAC (https://cciethebeginning.wordpress.com/2008/10/15/differences-between-pvst-and-pvst/)
All 0180.c200.0000 STATIC CPU (IEEE BPDU) Spanning Tree Protocol (for bridges) IEEE 802.1D)
or DMAC "the Nearest Customer Bridge group MAC address; propagation constrained by customer bridges; this gives the same coverage as a customer-customer MACSec (IEEE Std 802.1AE) connection."
(note: LLDP packets with mac 0180.c200.0003 or 0180.c200.0000 will be dropped and not learnt.)
All 0180.c200.0001 STATIC CPU Ethernet flow control (Pause frame) IEEE 802.3x
All 0180.c200.0002 STATIC CPU LACP Multicast / Ethernet OAM Protocol IEEE 802.3ah or "the Nearest non-TPMR (Two-Port MAC Relay) bridge group MAC address; propagation constrained by all bridges other than TPMRs; intended for use within provider bridged networks"
All 0180.c200.0003 STATIC CPU DMAC "the Nearest non-TPMR (Two-Port MAC Relay) bridge group MAC address; propagation constrained by all bridges other than TPMRs; intended for use within provider bridged networks."
(https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj43529/?referring_site=ss&dtid=osscdc000283) (note: LLDP packets with mac 0180.c200.0003 or 0180.c200.0000 will be dropped and not learnt.)
All 0180.c200.0004 STATIC CPU
All 0180.c200.0005 STATIC CPU
All 0180.c200.0006 STATIC CPU
All 0180.c200.0007 STATIC CPU
All 0180.c200.0008 STATIC CPU Spanning Tree Protocol (for provider bridges) IEEE 802.1AD (https://learningnetwork.cisco.com/thread/38323)
All 0180.c200.0009 STATIC CPU
All 0180.c200.000a STATIC CPU
All 0180.c200.000b STATIC CPU
All 0180.c200.000c STATIC CPU
All 0180.c200.000d STATIC CPU
All 0180.c200.000e STATIC CPU DMAC "The Nearest bridge group MAC address; propagation constrained to a single physical link; stopped by all types of bridge."
All 0180.c200.000f STATIC CPU
All 0180.c200.0010 STATIC CPU
All ffff.ffff.ffff STATIC CPU

01-80-C2-00-00-21 GARP VLAN Registration Protocol (also known as IEEE 802.1q GVRP)
01-80-C2-00-00-30 - 01-80-C2-00-00-3F Ethernet CFM Protocol IEEE 802.1ag
All 0100.0CCC.CCCC STATIC CPU = DTP / CDP / VTP
ALL 0100.0CCC.CCCD STATIC CPU = Non-Native VLAN BPDU & Cisco Shared Spanning Tree Protocol Address
01-00-5E-xx-xx-xx 0x0800 IPv4 Multicast (RFC 1112) (01-00-5E-00-00-00 - 01-00-5E-7F-FF-FF)
33-33-xx-xx-xx-xx 0x86DD IPv6 Multicast (RFC 2464)

01-1B-19-00-00-00, or 01-80-C2-00-00-0E (0x88F7) Precision Time Protocol (PTP) version 2 over Ethernet (layer-2)