3

I need to find out what port a MAC address is connected to.

Given a Cisco 3750, I can do a

show mac address-table dynamic

and see all the mac addresses that the switch has seen frames travelling to and from.

But I have a physical machine hosting some vms. That physical machine has two nics teamed and they trunk to this Cisco 3750. While the vms are actively communicating, the host machines aren't sending data so their macs aren't in the table.

I know from my sh mac address-table that the ports on the switch are 1/0/15 and 2/0/15 (it's a stack of two) because I can see the macs of the vms in the address table. But I want to know which of the switch ports is physically connected to eth0 and eth1 on the server. I know the macs of the physical nics. I just can't work out how to arp ping them from the switch and get some sort of reply.

Thanks in advance.

I should add that physically tracing the cables is out of the question and I need to do this remotely. I'll be putting the data in a visio chart.

  • 2
    This is what LLDP is for. If they're teamed, it's entirely likely you won't see the physical MACs on the network at all. – Ricky Beam Nov 13 '14 at 22:02
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 14:02
1

This depends on what OS the VM's are running. If they're running Linux or some other UNIX variant you can use arping to accomplish this. If they're running Windows (XP/7/8), whenever a new IP address is added to an interface, Windows will send gratuitous ARPs for that IP address for duplicate address detection by default, so you may be able to get the MAC address that way.

  • They are a mixture of linux, bsd and windows. I can see the arping command but it tells me "unknown address". Are you please able to provide an example usage assuming the mac I wanted was aa:bb:cc:11:22:33 and I'm running the command from Linux – A J Rossington Nov 13 '14 at 19:36
  • 1
    You run arping to an IP address, not a MAC address. If there's an upstream layer 3 device from the switch you may be better off querying its ARP table for the VM MAC's. – John Jensen Nov 13 '14 at 21:33
  • 1
    nmap -sP 10.5.192.0/24, where that subnet is the Vlan you're interested in, is a good way to populate the mac address table. nmap is cross-platform as well. – Mike Pennington Nov 14 '14 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.