Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Is there a way to derive the IP of a device from their MAC address on a Cisco device?
Assume you are not on a local segment where ping sweeping / arp are possible, instead you are remote and there are many routers between you and the endpoint.
Additionally the arp table on the Cisco device in question does not already include this MAC address.
There are a couple of options.
If you are doing DHCP snooping, you should be able to find the IP address in the binding database with the following command:
show ip dhcp snooping binding 00:00:00:00:00:00
If you don't have DHCP snooping, the Cisco device is on the same subnet (or supports multip SVIs so you can add an interface on the subnet), you are on a newer IOS (12.2ish or better) with access to TCL, and the device will respond to a ping, then you can use a TCL script. You can find many examples on the internet, one of which can be found here. Once it is able to ping the device (on the same subnet), it should be in the ARP table of the Cisco device.
Generally, it would be quicker/easier to check on the L3 device for the ARP entry or the DHCP server then the second option.
Old answer (prior to question change): Strictly answering your question, no there is no way to derive an IP address of a device from the MAC address table entry.
The MAC address table is strictly speaking a L2 set of information, tying devices to an interface. At L2, there is no awareness of an IP address (as the L3 and above information is irrelevant to L2 and could just as easily be another protocol).
You would need access to the L3 device for the remote network segment where you could look up the entry in the ARP table.
TL;DR -- You'll have to find the MAC in someone's ARP table -- eg. the gateway router.
As YLearn originally said, you're looking for a L3 address given only a L2 address. You'll have to find something within an appropriate L3 domain to find it. If the switch doesn't have a L3 interface in the same network, then it's arp table won't show anything. If the device isn't using DHCP (and/or dhcp snooping isn't running on the switch), it won't show up in the snooping table. I would presume there's a router somewhere that's the gateway for the target device; it's arp table should show the ip-mac link.
Worst case, the mac would pin the device down to the port. You'll have to watch the traffic on that port to find any IP address(es).
debug ip packet but USE CAREFULLY!) Bottomline, there's gotta be a router somewhere for that L3 domain somewhere, assuming it's talking to anything else.