cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
12886
Views
0
Helpful
5
Replies

MAC Address table --> "system" type entries

alex_ciobanu
Level 1
Level 1

Hello,

Maybe someone could give me a definition or explanation of the mac-address table entries of "system" type ?

I find on many switches many entries with the broadcast address ffff.ffff.ffff defined by the system.

show mac address-table interface Gi1/16

Multicast Entries

vlan    mac address     type    ports

-------+---------------+-------+--------------------------------------------

  41    ffff.ffff.ffff   system Gi1/16,Gi1/23,Gi1/24,Gi3/7,Gi3/11,Gi3/16

                                Gi3/20,Gi3/23,Gi3/29,Gi3/47,Gi4/12,Gi4/13

                                Gi4/14,Gi4/22,Gi4/47,Gi7/23,Gi7/45,Gi7/47

                                Gi8/5,Gi8/6,Po6

Thanks !

5 Replies 5

Peter Paluch
Cisco Employee
Cisco Employee

Hello Alex,

In my understanding, these entries are placed into the MAC address table to make sure that certain multicast and broadcast frames are (also) delivered to the CPU of the switch. Otherwise, broadcasts and specific multicasts (think CDP, VTP, STP and many more) would be simply switched through the switch without being processed by its CPU and in turn, the IOS. If you have a look at the show mac address-table without the interface specification, you will see that these specific multicast and broadcast MAC addresses have "CPU" as their outgoing interface.

Best regards,

Peter

Ok, but the STP frames are sent to the MAC address of  01-80-C2-00-00-00, and CDP, VTP, DISL, PAgP, and DTP: 01-00-0C-CC-CC-CC, not to broadcast addresses.

And also, you are stating that all the broadcast frames are processed in software, and not in hardware ?

Thanks !

Hi Alex,

Ok, but the STP frames are sent to the MAC address of   01-80-C2-00-00-00, and CDP, VTP, DISL, PAgP, and DTP: 01-00-0C-CC-CC-CC,  not to broadcast addresses.

Correct. And they are also put into the MAC address table:

Switch# show mac address-table

          Mac Address Table

-------------------------------------------

Vlan    Mac Address       Type        Ports

----    -----------       --------    -----

All    0100.0ccc.cccc    STATIC      CPU

All    0100.0ccc.cccd    STATIC      CPU

All    0180.c200.0000    STATIC      CPU

All    0180.c200.0001    STATIC      CPU

All    0180.c200.0002    STATIC      CPU

All    0180.c200.0003    STATIC      CPU

All    0180.c200.0004    STATIC      CPU

All    0180.c200.0005    STATIC      CPU

All    0180.c200.0006    STATIC      CPU

All    0180.c200.0007    STATIC      CPU

All    0180.c200.0008    STATIC      CPU

All    0180.c200.0009    STATIC      CPU

All    0180.c200.000a    STATIC      CPU

All    0180.c200.000b    STATIC      CPU

All    0180.c200.000c    STATIC      CPU

All    0180.c200.000d    STATIC      CPU

All    0180.c200.000e    STATIC      CPU

All    0180.c200.000f    STATIC      CPU

All    0180.c200.0010    STATIC      CPU

All    ffff.ffff.ffff    STATIC      CPU

And also, you are stating that all the broadcast frames are processed in software, and not in hardware ?

Thanks !

Well, somebody from Cisco should give a definitive answer here but as far as my understanding goes, while the broadcasts/multicasts are not replicated by CPU, they are - at least for selected multicast/broadcast MAC addresses - delivered to the CPU together with being flooded through appropriate switchports. At least that is what the output of the show mac address-table tells me.

By the way, is what you originally posted really the output of the show mac address-table interface command? I've tried to replicate that on my 3560 but the format of the output was quite different.

Best regards,

Peter


I got the output from a WS-C4510R-E switch, and the nice part is that I don't see the CPU entries at all in the mac address table. Probably its something related to this model only.

Funny part is that I try to see on a 6500 switch and I do not see anything.

xxxxxx#  show mac address-table  | inc CPU

xxxxxx#  show mac address-table  | inc system

xxxxxxx#  show mac address-table  | inc fff

xxxxxx#

On WS-C3550-48-SMI I see only the CPU entries, without the ffff.

On WS-C3560-24TS the same...

2950 the same, only CPU.

Anyway I think it differs from model to model the way the mac address table is designed for 'view'. Until now I only saw 4500 that has both fff entries and CPU entries in the mac address table.

hpsisupport
Level 1
Level 1

https://en.wikipedia.org/wiki/Multicast_address#cite_note-15

 

https://support.huawei.com/hedex/pages/EDOC100010596830008125/05/EDOC100010596830008125/05/resources/message/cd_feature_lldp_message_format.html

 

http://www.ieee802.org/1/files/public/docs2002/lldp-protocol-02.pdf

 

https://learningnetwork.cisco.com/thread/38323

 

https://learningnetwork.cisco.com/thread/91091

 

https://learningnetwork.cisco.com/thread/10473 

 

https://learningnetwork.cisco.com/thread/9625

 

 

 

All 0100.0ccc.cccc STATIC CPU This MAC is used for L2 protocols such has CDP, VTP, DISL, PAgP, , UDLD (https://quickview.cloudapps.cisco.com/quickview/bug/CSCsw80664)
All 0100.0ccc.cccd STATIC CPU (SSTP BPDU) for native VLAN / PVST+ native VLAN is send a second time tunneled over IEEE 802.1q using special multicast MAC (https://cciethebeginning.wordpress.com/2008/10/15/differences-between-pvst-and-pvst/)
All 0180.c200.0000 STATIC CPU (IEEE BPDU) Spanning Tree Protocol (for bridges) IEEE 802.1D)
or DMAC "the Nearest Customer Bridge group MAC address; propagation constrained by customer bridges; this gives the same coverage as a customer-customer MACSec (IEEE Std 802.1AE) connection."
(note: LLDP packets with mac 0180.c200.0003 or 0180.c200.0000 will be dropped and not learnt.)
All 0180.c200.0001 STATIC CPU Ethernet flow control (Pause frame) IEEE 802.3x
All 0180.c200.0002 STATIC CPU LACP Multicast / Ethernet OAM Protocol IEEE 802.3ah or "the Nearest non-TPMR (Two-Port MAC Relay) bridge group MAC address; propagation constrained by all bridges other than TPMRs; intended for use within provider bridged networks"
All 0180.c200.0003 STATIC CPU DMAC "the Nearest non-TPMR (Two-Port MAC Relay) bridge group MAC address; propagation constrained by all bridges other than TPMRs; intended for use within provider bridged networks."
(https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj43529/?referring_site=ss&dtid=osscdc000283) (note: LLDP packets with mac 0180.c200.0003 or 0180.c200.0000 will be dropped and not learnt.)
All 0180.c200.0004 STATIC CPU
All 0180.c200.0005 STATIC CPU
All 0180.c200.0006 STATIC CPU
All 0180.c200.0007 STATIC CPU
All 0180.c200.0008 STATIC CPU Spanning Tree Protocol (for provider bridges) IEEE 802.1AD (https://learningnetwork.cisco.com/thread/38323)
All 0180.c200.0009 STATIC CPU
All 0180.c200.000a STATIC CPU
All 0180.c200.000b STATIC CPU
All 0180.c200.000c STATIC CPU
All 0180.c200.000d STATIC CPU
All 0180.c200.000e STATIC CPU DMAC "The Nearest bridge group MAC address; propagation constrained to a single physical link; stopped by all types of bridge."
All 0180.c200.000f STATIC CPU
All 0180.c200.0010 STATIC CPU
All ffff.ffff.ffff STATIC CPU

01-80-C2-00-00-21 GARP VLAN Registration Protocol (also known as IEEE 802.1q GVRP)
01-80-C2-00-00-30 - 01-80-C2-00-00-3F Ethernet CFM Protocol IEEE 802.1ag
All 0100.0CCC.CCCC STATIC CPU = DTP / CDP / VTP
ALL 0100.0CCC.CCCD STATIC CPU = Non-Native VLAN BPDU & Cisco Shared Spanning Tree Protocol Address
01-00-5E-xx-xx-xx 0x0800 IPv4 Multicast (RFC 1112) (01-00-5E-00-00-00 - 01-00-5E-7F-FF-FF)
33-33-xx-xx-xx-xx 0x86DD IPv6 Multicast (RFC 2464)

01-1B-19-00-00-00, or 01-80-C2-00-00-0E (0x88F7) Precision Time Protocol (PTP) version 2 over Ethernet (layer-2)

 

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco