3

I need to find out what port a MAC address is connected to.

Given a Cisco 3750, I can do a

show mac address-table dynamic

and see all the mac addresses that the switch has seen frames travelling to and from.

But I have a physical machine hosting some vms. That physical machine has two nics teamed and they trunk to this Cisco 3750. While the vms are actively communicating, the host machines aren't sending data so their macs aren't in the table.

I know from my sh mac address-table that the ports on the switch are 1/0/15 and 2/0/15 (it's a stack of two) because I can see the macs of the vms in the address table. But I want to know which of the switch ports is physically connected to eth0 and eth1 on the server. I know the macs of the physical nics. I just can't work out how to arp ping them from the switch and get some sort of reply.

Thanks in advance.

I should add that physically tracing the cables is out of the question and I need to do this remotely. I'll be putting the data in a visio chart.

Improve this question
2
  • 2
    This is what LLDP is for. If they're teamed, it's entirely likely you won't see the physical MACs on the network at all.
    – Ricky
    Commented Nov 13, 2014 at 22:02
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Commented Aug 7, 2017 at 14:02

1 Answer 1

Reset to default
1

This depends on what OS the VM's are running. If they're running Linux or some other UNIX variant you can use arping to accomplish this. If they're running Windows (XP/7/8), whenever a new IP address is added to an interface, Windows will send gratuitous ARPs for that IP address for duplicate address detection by default, so you may be able to get the MAC address that way.

Improve this answer
3
  • They are a mixture of linux, bsd and windows. I can see the arping command but it tells me "unknown address". Are you please able to provide an example usage assuming the mac I wanted was aa:bb:cc:11:22:33 and I'm running the command from Linux
    – A J Rossington
    Commented Nov 13, 2014 at 19:36
  • 1
    You run arping to an IP address, not a MAC address. If there's an upstream layer 3 device from the switch you may be better off querying its ARP table for the VM MAC's.
    – John Jensen
    Commented Nov 13, 2014 at 21:33
  • 1
    nmap -sP 10.5.192.0/24, where that subnet is the Vlan you're interested in, is a good way to populate the mac address table. nmap is cross-platform as well.
    – Mike Pennington
    Commented Nov 14, 2014 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.