I've been tasked with creating/finding out all of the network IPs for my building composed of 6 different groups that all go through my 4 core switches that I'm responsible for. I don't yet have any access to my network monitoring tools like solar winds, etc.

Is there anyway to figure out which IPs are where? and when I get an IP, can I figure out the subnet to see how many addresses are in use or are being wasted?

  • Have you looked in the DHCP server(s) to see what has been assigned. If you have no access to the network tools, I'm not sure how much help anyone can give you.
    – Ron Maupin
    Commented Aug 11, 2016 at 18:40
  • Answered here stackoverflow.com/questions/13669585/… Commented Feb 8, 2017 at 3:50
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 14, 2017 at 23:01

2 Answers 2


If you don't have access to network management tools, then you can do this the manual way using CLI on the network devices.

The ARP cache on the core routers is the key to some of the information you need. Use the following command on a Cisco router to display the ARP cache.

show ip arp

This will give you a list of the IP addresses of all the devices that have sent an ARP response in the last 4 hours. You may have to repeat this command over a few days to make sure you catch anything that isn't powered on often.

If you want to track down the location of a device the most you can do is track down the switch port that the device is connected to. Look at the switch MAC address table. For a Cisco switch use the following:

show mac-address table

For each MAC address in the ARP cache, check the MAC address table and look at which interface the MAC address was learned on. If the outgoing interface points to another switch then you will need to log onto that switch and do the same until you get to an interface that doesn't connect to another switch. Once you discover the final interface that MAC address was learned on, you have discovered the switch port that the IP address/device is connected to.

If you look at the core switch configuration each interface will have a subnet mask associated. You can use work out how many addresses are useable in that subnet. Compare that to the compiled list of ARP entries you have recorded over a period of time and then you can know how many addresses are in use. The more you check the ARP cache, the more accurate your result will be.


Look through your DHCP server to view bindings and match MAC addresses to IPs.

As Qualeboy said, check your mac address table on each switch to see which MAC addresses are forwarded to which port.

Ping the broadcast address for each subnet (assuming this is what you meant by groups?). This will populate the ARP cache with all live hosts from that subnet which you can then map to physical ports using the MAC table as discussed above.

An alternative to using the CLI is to download a program such as ZenMap. Install the program on a host attached to the network then run scans of each subnet that you want to discover devices on. This is not a comprehensive solution to finding all devices and security policies on your switches may hinder it's operation, but it can be a quick method for giving a general picture of the network. Better to rely on the cli method if you are making design decisions based on this information.

source: I've just completed this task on a 125 device network.

Not the answer you're looking for? Browse other questions tagged or ask your own question.