Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I see the MAC address table of a Windows network bridge? Is it possible trough command line to find this information?

EDIT: I am interested to see the same table that it is possible to see in the managed switches (e.g. like the Cisco's show mac-address-table or Linux brctl showmacs br0)

share|improve this question
up vote 3 down vote accepted

The Network Bridge functionality appears to be wholly implemented (at least in Windows 7) by the bridge.sys driver. Without access to the bridge.sys source code it's difficult to say anything with certainty, but some cursory sniffing around the binary doesn't show any exposed APIs that would be helpful in dumping the layer 2 adjacency table.

(This ASCII text string embedded in the binary is a nice touch, though: Without specific written consent from Microsoft, it is illegal to reverse engineer, debug or change this binary.)

I think you're out-of-luck, from a documented and supported command-line perspective. Searching Microsoft's website for any command-line (or otherwise) tools that deal with the network bridge (aside from the paltry support in netsh) isn't turning up anything for me.

It's interesting to note that the names of the registry parameters specified for the Windows CE network bridge driver are present in the Windows 7 bridge.sys driver. This tends to make me think that these registry settings would work (not that any of them are helpful to you).

Dumping Windows kernel pool allocations is above my pay grade, but I suspect that if you were to figure out what the bridge.sys pool tag was (I suspect it's Brdg) and dump any pool allocations it makes you'd find the adjacency table in one of those allocations. Making that into a useful tool is left as an exercise to the reader. (>smile<)

share|improve this answer

on a windows system, you can run arp -a to display the arp table for each interface.. is that not what you are looking for?

share|improve this answer
arp only shows mac-addresses associated with IP-addresses. There can be a lot more going on than just IP traffic. – Tonny Aug 10 '12 at 18:45
nmap sweep would show all mac addresses no? I believe there's a port to windows. – QuentinMoss Aug 10 '12 at 18:51
Tis true.. would only show IP related MAC-addresses. – Rex Aug 10 '12 at 18:54
First, the ARP table wouldn't even show MAC addresses associated with IP addresses unless the system had to associate them locally, which a bridge typically doesn't have to do. Second, Windows has to have a MAC address table independent of its L3 operation, otherwise it couldn't bridge Ethernet interfaces, and we know it can. – David Schwartz Jul 6 '14 at 9:23
@DavidSchwartz - The confusion people seem to have between ARP tables and layer 2 adjacency tables has amazed me for a long time. Books and other resources referring to layer 2 adjacency tables as "ARP tables" hasn't helped matters. I've pretty much just given up trying to explain it to people. – Evan Anderson Jul 6 '14 at 10:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.