What is the best method of locating a particular workstation on a VLAN ?

I sometimes need to do this, if a workstation IP address, shows up on an ACL Deny

  1. torrent use
  2. High bandwidth usage (Top Talkers)
  3. Snort alert

    The way I do it now,

    • Logon to a core switch in the same VLAN
    • Ping the IP address,
    • Retrieve the MAC from the ARP table
    • Mac address lookup to see which switch it was learned from
    • logon to that switch rinse and repeat until I locate the workstation

sometimes this can take logging in to ~7 switches, there are specific challenges to this network that I can do nothing about at the moment. Huge VLANs (/16) with a few hundred users on each VLAN

in an all Cisco shop, with minimal budget using Cisco switches, there must be a more efficient way to track down host machines ?

EDIT: To add further details

Specifically I'm looking for the switch-port the user is connected to ? also some history would be great .. because my approach only works while the user is still connected, and no value when i review the logs in the morning, but the device is no longer connected.

There is no central DNS or Active Directory it is like a Guest Network, where only internet access is provided. I try to provide some management and a bit of security.

I've tried "show ip dhcp binding | inc " it gives me a strange MAC (with 2 extra characters) that is not the associated device MAC, I have not looked into this yet, but ARP is accurate and I'm more concerned with finding the switch port the offending machine is connected to.

hope this provides some clarification

  • 2
    Regarding your "show ip dhcp binding | inc ": The extra characters at the front are the media type. If you remove the first two characters, you're left with the client MAC. The two digits representations are in table 2: freesoft.org/CIE/RFC/1700/24.htm Jun 6, 2013 at 0:48
  • @legioxi, this assumes the device id'd itself using the MAC. If it used a string, that may be what the server shows.
    – Ricky
    Jun 6, 2013 at 4:22

11 Answers 11


Take a look at Layer2 traceroute (for cisco).. Cdp should be running btw...

Router# traceroute mac 0000.0201.0601 0000.0201.0201
Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (
con6 ( :Fa0/1 => Fa0/3
con5                 (        )  :    Fa0/3 => Gi0/1
con1                 (        )  :    Gi0/1 => Gi0/2
con2                 (        )  :    Gi0/2 => Fa0/1
Destination 0000.0201.0201 found on con2[WS-C3550-24] (
Layer 2 trace completed
Router# traceroute mac 0001.0000.0204 0001.0000.0304 detail 
Source 0001.0000.0204 found on VAYU[WS-C6509] (
1 VAYU / WS-C6509 / :
                Gi6/1 [full, 1000M] => Po100 [auto, auto]
2 PANI / WS-C6509 / :
                Po100 [auto, auto] => Po110 [auto, auto]
3 BUMI / WS-C6509 / :
                Po110 [auto, auto] => Po120 [auto, auto]
4 AGNI / WS-C6509 / :
                Po120 [auto, auto] => Gi8/12 [full, 1000M] Destination 0001.0000.0304 
found on AGNI[WS-C6509] ( Layer 2 trace completed.
  • This is amazing, I'm playing around with it now. Exactly what I was looking for
    – hyussuf
    Jun 6, 2013 at 22:01

We use the mactrack plugin on Cacti to do such things. Works quite well, historical data is also available.

As long as the ARP and MAC address tables are available via SNMP then it works. The only small problem we had is where the layer 3 instance for a site is an ASA. We just worked around this by pulling the ARP table via scripts and generating an arpwatch file, since mactrack supports that.

Example screenshot from our setup: enter image description here

Imgurl link: https://i.stack.imgur.com/mZjS2.png

  • Nice! May be better to throw up a bigger picture on imgur or something. I can't see much of that at all. :-) Jun 6, 2013 at 21:28
  • @JohnJensen Yeah, that's just stackexchange scaling the picture down, it's uploaded in full size. Try opening the image in another tab, for example "Right click - open image in new tab in Chrome". Will add a link to the answer anyway. Jun 7, 2013 at 6:01

There are a couple of ways to do this on the cheap (the exercise of research and/or implementation I'll leave up to you).

  1. Have a script that logs in to each one of your edge devices and grabs the MAC address tables off of them. You'll want to exclude trunk interfaces for this, but it would be trivial to create a hash (or dict for you python people) with the keys being the edge switches and the values being another hash that's basically "mac.addr -> interface". This will eliminate the need for you to chase down MACs on your edge switches, which is most of the legwork it seems. I can recommend using Perl's Net::Appliance::Session or Python's exscript to make this happen (this assumes you have access to a *NIX box).

  2. Use SNMP to query this data, which will eliminate the need for a script to actually log in to switches and run commands. You're on your own to look up MIBs for the MAC address tables, but here's a Google search to get you started.

  3. If you're on Windows only, you can use SecureCRT or TeraTerm to set up macro's to "half-automate" this for you, but my experience with either of those is very limited, so YMMV.

Hope that gives you some ideas.


I like to have a script that grabs show arp and show cam dyn output every 15 minutes, I timestamp it with term exec prompt timestamp so we have a rough correlation for times. Then I append all switch output to a file... one file per switch, per day.

All these logs are kept in the same directory for easy grepping.

Finding hosts becomes a fairly simple grep exercise if you know the topology... Stuck in windows without grep? Use cygwin...


Why not simplify things and do an nslookup on the IP, grab the hostname from DNS and use the hostname to find the computer via an asset list or management database? Or if you don't have reverse DNS setup you could log into the DHCP server to pull the host name.

I know it isn't a Cisco/CLI method, but it should work if your users are assigned to computers 1-1. If you are many to 1, you can use Windows/Linux tools to find out the current user of the computer.

  • I don't think hyussuf is trying to find who is on the computer - as this is Network Engineering, and by the example he provided, I'm presuming he's trying to determine which physical port a device is connected to, and that device may not always be a workstation.
    – Mark
    Jun 5, 2013 at 23:26
  • True, not only that, but this is kind of a Guest Network, the only service we provide is internet, mixture of BYOD and small companies requring internet access to do their work. technically an ISP in a remote location with all kinds of users. The cisco routers are my dhcp servers, when I look at the binding info, the MAC is completely wrong it even has an extra 2 characters have'nt looked into that yet.
    – hyussuf
    Jun 5, 2013 at 23:28
  • Also my main goal is to locate the offending switch port and disconnect or 'shut' down ... I apologize, cant figure out how to new line
    – hyussuf
    Jun 5, 2013 at 23:34
  • You may wish to update the question with more details from the two comments you posted to my answer. Definitely some good info to help with the answers. Jun 5, 2013 at 23:43

You're doing it the same way I would do it manually.

There is software out there that will take the manual steps out of it for you. A tool included in SolarWinds Engineering Toolkit will, although unfortunately it's not cheap. I'm sure there are other alternatives.

If you're down for an in-between solution or some scripting work, take a look at the SNMP commands issued in this answer for an idea of how you could script it from a system with a CLI SNMP client

Edited to add: I presume that your "rinse and repeat" is not re-including the ping and whatnot along the way. Once you've determined the mac address you should be able to just do sh mac addr | in #### (whoops angle brackets disappear)

  • correct, ping only once, "show mac add | inc ####" , mixed in with some show cdp neighbor multiple times
    – hyussuf
    Jun 5, 2013 at 23:26
  • I'll disclose that I have access to both the Engineering Toolkit as well as the User Device Tracker (solarwinds.com/user-device-tracker.aspx) and 99% of the time I end up logging in to switches and just doing it manually. Admittedly it's rare I have to go 7 deep, but it just works.
    – Mark
    Jun 5, 2013 at 23:30
  • My SNMP-fu is not strong, but that link is very interesting, and has given me some ideas.
    – hyussuf
    Jun 6, 2013 at 15:05

You are asking two things.
1.Locate a MAC on your network - I advise to create a script (php) and use SNMP to query all MAC address-table to give you the switch/port where is located the IP/MAC address.

2.Monitor Usage of your (torrent use,High bandwidth usage (Top Talkers),Snort alert) - Use a solution as ntop to monitor the flows on your network. I'd used this a long ago and was great.


Just a suggestion... if you have some sort of active syslog inspection that can trigger on specific events, you could write a script to SNMP lookup the IP on every switch so know where it was roughly around the time the event happens.

(sorry, I cannot find the exact OIDs)

Edit: link "Using SNMP to Find a Port Number from a MAC Address on a Catalyst Switch" I forgot about the comm@vlan trick. There are a lot of tables to ping to find all the information needed for a human. :-(


switchmap is another tool which can be used to keep track of which mac address is behind which switchport (amongst other things).


I've used netdisco to collect this information. It will allow one to query the data base with a hostname, IP address, MAC address, etc. and return the switch and switchport. It will do some other useful things as well.


You might find this link helpful


  • It is generally considered good style on Net Eng SE to include the basic details of your answer, and to provide a link to reference materials if necessary. (Because, "link rot" means eventually that URL won't go anywhere useful.) Jun 26, 2013 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.