Linux中如何导出MAC地址表？为何基础MAC表查询仍存挑战？

Great question—this is a common point of confusion for folks moving from dedicated network gear (like switches) to Linux’s flexible, modular network stack. Let’s break down both parts of your query.

Why No Single "Show MAC Table" Command? #

Linux is a general-purpose OS, not a purpose-built network switch. Its layer 2 forwarding logic (and associated MAC address tables) lives in distinct components depending on your setup:

• Kernel bridges: For basic layer 2 switching between physical/virtual interfaces.
• Open vSwitch (OVS): A software-defined switch for virtualized environments (think Kubernetes, OpenStack).
• Hardware-offloaded NICs: Some network cards have their own MAC tables, but these are vendor-specific.

Unlike dedicated switches (which have a single, centralized MAC table for forwarding), Linux spreads layer 2 data across these components. A one-size-fits-all show mac-table command can’t work because the data is stored in different formats and locations. Instead, Linux follows its philosophy of small, focused utilities that target specific components—this keeps the system flexible for diverse use cases.

How to Export MAC Address Tables in Linux #

The method depends on which layer 2 component you’re using. Here are the most common scenarios:

1. For Kernel Bridges #

Kernel bridges use a Forwarding Database (FDB) as their MAC address table. To view and export it:

• View the full FDB:

  bridge fdb show
  

• Export to a text file:

  bridge fdb show > bridge_mac_table.txt
  

• Filter results to a specific bridge (e.g., br0):

  bridge fdb show br0 > br0_mac_table.txt
  

The output includes MAC addresses, associated bridge ports, VLAN IDs (if applicable), and whether entries are static or dynamic.

2. For Open vSwitch (OVS) #

If you’re using OVS for virtualized networking, use its dedicated tools to access the MAC table:

• View the MAC table for a bridge (e.g., br-int):

  ovs-appctl fdb/show br-int
  

• Export to a file:

  ovs-appctl fdb/show br-int > ovs_mac_table.txt
  

For flow-based MAC details, you can also run:

ovs-ofctl dump-flows br-int | grep dl_src > ovs_flow_mac.txt

3. Important Distinction: ARP Cache vs. Switch MAC Tables #

Don’t mix up the local ARP/ND cache (which maps IPs to MACs for the host’s direct communication) with a switch’s forwarding table. To export the ARP cache:

ip neigh show > arp_cache.txt

This is not a layer 2 forwarding table—it’s just the host’s record of devices it’s interacted with directly.

内容的提问来源于stack exchange，提问作者Abhishek Sagar