Good day all,
Suppose I am monitoring a large network and do not have physical access to the devices and want to find out what port a device is on. What are some techniques I can use to help accomplish this goal?
One way I can think of is to obtain a trace route from the source machine to a destination ip address.
Then use this to find the router that the device is using to leave the network.
Log into the router and run the command sh ip arp | include [ip address of host]
Once I have the mac address, I will log into the on that LAN switch and type sh mac-address-table | include [mac address of host]
I believe this should point me to the right direction of what port the host is using. I might have some issue if the the interface is setup as a port-channel. If that is the case I may need to run sh int port-channel (correct me if I am wrong).
If I am wrong in any of my steps please correct me, but are their any commands I am missing when trying to trace down the interface a host is on?