4

Good day all,

Suppose I am monitoring a large network and do not have physical access to the devices and want to find out what port a device is on. What are some techniques I can use to help accomplish this goal?

One way I can think of is to obtain a trace route from the source machine to a destination ip address.

Then use this to find the router that the device is using to leave the network.

Log into the router and run the command sh ip arp | include [ip address of host]

Once I have the mac address, I will log into the on that LAN switch and type sh mac-address-table | include [mac address of host]

I believe this should point me to the right direction of what port the host is using. I might have some issue if the the interface is setup as a port-channel. If that is the case I may need to run sh int port-channel (correct me if I am wrong).

If I am wrong in any of my steps please correct me, but are their any commands I am missing when trying to trace down the interface a host is on?

Improve this question
1
  • Just a tip, if you don't see the address in the arp table send a ping to that device from the switch. ARP tables do flush unless a static arp is entered.
    – Fixitrod
    Commented Sep 18, 2016 at 18:08

1 Answer 1

Reset to default
4

This is exactly the process I would use in most circumstances.

If you have CDP (Cisco Discovery Protocol) enabled on all your switches though, you can save a LOT of time by running Cisco's MAC Traceroute function.

traceroute mac ip <<gateway ip>> <<host ip>> detail

Where <<gateway ip>>> is the gateway address of the subnet the device you are trying to trace (or any other valid IP within that subnet).

0ffnet-LAB1#traceroute mac ip 172.16.0.1 172.16.0.188 detail
Translating IP to mac .....
172.16.0.1 => 00a0.6125.af0b
172.16.0.188 => 0029.8856.0f60

Source not directly connected, tracing source .....
Source 00a0.6125.af0b found on 0ffnet-LAB1[WS-C3550-48] (172.16.0.1)
1 0ffnet-LAB1 / WS-C3550-48 / 172.16.0.1 :
Fa0/27 [auto, auto] => Fa0/3 [auto, auto]
2 0ffnet-LAB2 / WS-C3550-48 / 172.16.0.2 :
Fa0/1 [auto, auto] => Fa0/2 [auto, auto]
Destination 0029.8856.0f60 found on 0ffnet-LAB2[WS-C3550-48] (172.16.0.2)
Layer 2 trace completed.
0ffnet-LAB1#

If you need to do this on a regular basis (e.g.: you're the network administrator), then there are tools which can automate this process by collecting the MAC tables regularly from your devices and store them in a database e.g.:

http://netdbtracking.sourceforge.net

You can easily do something similar with SNMP and a bit of coding experience.

Improve this answer
1
  • 1
    +1 but since OP wrote ` I will log into the on that LAN switch` perhaps it would be good to clarify explicitly (since you already imply it but I think it could be made more clear) that the LAN may consist of more than one switch and so the first switch you log into may see the MAC on a link to another switch etc.
    – hertitu
    Commented Sep 17, 2016 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.