In both cases you learn the mappings by listening to the traffic.

Is your SRX being used as a switch (transparent mode)? It seems not, so forget the MAC table. On Junos, the following commands can be used:Ģ- to check the MAC table: show ethernet-switching table or show bridge mac-table (it depends of the platform, you haven't said which SRX you are using) A MAC table exists on a switch.Īs you see these are two highly distinct concepts. Layer 2) a frame destinated to MAC X please forward through port Y. Basically it means: if you want to switch (i.e. An ARP table exists on hosts (PCs) and routers.Ģ- A MAC table is a mapping between a MAC address and a port on a switch. Basically it means: if you send/route an IP packet to IP X please use MAC Y. You need an ARP table when you want to send/route an IP packet ( Layer 3) to some host. I will explain very briefly:ġ- An ARP table is mapping between a MAC address and an IP address. You should review your concepts of ARP and Layer 2 switching. So, how can I see all the MAC addresses of devices that reside on LAN(s) that sit right next to our SRX device?

Our SRX box is a firewall, and since a lot of traffic passes over it, its 'show arp' output is large due to returning packets containing the MAC addresses in it, even if the device is two hops away and not locally attached on a LAN. Now for an SRX device, the 'show ethernet-switching table' does not exist, so how can I see all the MAC addresses that shares LAN(s) with the SRX device? Also to my understanding, the 'show ethernet-switching table' shows all devices that shares a LAN with the local device (EX in this case), regardless if traffic was passed onto it or not. To my understanding, the 'show arp' only reports devices where 'communication' was sent to, such as a ping, ssh, http or some other direct traffic towards the device. Our EX device has 222 unique MAC addresses in the 'show ethernet-switching table' output whereas the 'show arp' command shows only 32 MAC addresses.

Cmd ping mac address