Cisco Switch: trigger mac-address table update

Question

If I run show mac-address-table dynamic I get a bunch of mac addresses on that table. But due to the aging parameter, I don't see the mac addresses of all possible devices on the network that come through that switch. Is there a way to force an update, perhaps pinging a broadcast IP or any other way, which would include all possible mac adresses? One possibility I know is ping sweep, but that might take a long time (longer than 5 minutes of aging time) and I'd like to see if there is any alternative.

Solution 1

The switch only learns about MAC addresses when a device sends an Ethernet frame to it. So the only way to get the CAM table populated with all of the devices is to get all of the devices to talk.

however, I think you're over thinking the problem. if you just start with what is already there I bet you will get most, if not all, of your devices.

Solution 2

Unless you've got thousands of hosts a ping sweep should almost certainly complete before the switch MAC table caches out the entries. Have you run a ping sweep to check the results?

Comments

[longneck]

The short answer is no, there is not a way to get ALL devices to send a frame so they show up in the CAM table. However, your question sounds like a poor solution to any problem. What are you really trying to accomplish?

[Megaslav]

I have a very long list of mac addresses of different servers on the network and I need to match them against CAM tables of all switches in order to find out to which defices it's connected directly (I already know how to get CAM table of mac addresses that are directly connected).

[Megaslav]

That is what I though, however currently we scan at night and reading CAM tables from almost every switch, we get around a third or half of all the devices. That's possibly because we ran at night and different servers have activity during different times of day.

[Megaslav]

We've got several thousands of hosts, and the sweep takes around half an hour. Unless I find another solution, I'm thinking of sweeping by ranges and running several CAM checks.

[Megaslav]

I didn't know about this feature, thanks! It would be useful in case we had few devices, however we've got over 300, so pushing this change on all them isn't that viable.

[longneck]

That's possible. Run the script during the day.

[longneck]

Have you looked at nMap? The ping sweep in nMap is very fast.

[Megaslav]

You are right. looks pretty fast, took around 5 minutes to ping 140 /24 vlans. If somehow I can run it faster, it might even work for me.