6

I have a Cisco Catalyst that has a port that is up up, and the device does not show in the ARP table. The MAC address-table shows a MAC address for the port. What can I do from that switch to find out what the device is?

2
  • If you know what IP scope the device is located in, for instance by checking what VLAN it's assigned to, scanning the network subnet (with an IP scanner) might help updating the ARP and therefore show what IP is assigned to that device. I use this on a weekly basis in order to find devices which has the problem you describe.
    – user36472
    Oct 27, 2017 at 5:54
  • no knowledge of what ip its trying to grab it doesn't match the vlan etc. it may be any thing from a forgotten ipcam that reset back to factory defaults to an illegal device that some one tried to put on the network.
    – Kendrick
    Oct 28, 2017 at 4:20

3 Answers 3

5

ARP is a protocol to resolve a layer-3 address to a layer-2 address. If there is no layer-3 address assigned to the device, then ARP cannot help you.

Apparently, the device is sending frames because the MAC address shows in your MAC address table. You can check the OUI to see the NIC manufacturer of the device. You could also try CDP and LLDP to see if the device responds to either of those.

6
  • It would not normally respond to cdp lldp unfortunatly. Some of the ip cams will show up in the power statistics that way to.
    – Kendrick
    Oct 28, 2017 at 4:22
  • LLDP is the industry standard for discovery. There really is nothing else to help you.
    – Ron Maupin
    Oct 28, 2017 at 6:28
  • Is it a possibility to add a mirrored port and then use a packet sniffer to read the frames and see what ip address they claim to be from? or would a switch vlan not care what ip address the machine tries to claim. ie vlan1=10.1.1.0 and mystery device = 192.168.1.2 at which point the arp on the cisco could see the 192.168.1.2 address regaurdless of what the vlan is being used for just not route the traffic?
    – Kendrick
    Nov 8, 2017 at 15:35
  • Maybe, if the device actually has an IP address assigned, but this seems like a lot of work. I know your question is about finding it using the switch, but if you are going to go to all this trouble, wouldn't it be easier to look in the DHCP server, or check the ARP table on the router?
    – Ron Maupin
    Nov 8, 2017 at 15:39
  • I was asking the question from the prospective of some one gets hired to replace the 1 it guy in the shop who designed every thing and never documented any thing, and then the switch gets wiped/damaged. Some devices are set statically for example 3 of the 4 security cameras have a static ip out of the box and if the device resets to default or something wierd you then don't know what ip it is using w/o the box. cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/… for the lldp commands.
    – Kendrick
    Nov 8, 2017 at 16:09
0

It looks like you can configure Link Layer Discovery Protocol on endpoint computers, Windows 10, and other Windows systems as well.

This would be your best bet as LLDP would give you rich info.

0

You mention it's a multilayer switch but don't say if the VLAN this device is in has an associated Layer 3 interface / IP on this switch. The device may be sending frames but if it doesn't have a Layer 3 interface to talk with on that VLAN, there will be no ARP entry. You could try enabling IP Device Tracking which will initiate ARP probes out the Layer 2 interface. The result is a Layer 3 address can be stored as being associated with the Layer 2 interface/ MAC, without the ARP table.

globally   --> ip device tracking 
interface  --> ip device tracking maximum 10 
show ip device tracking all 
1
  • all vlans would have an associated vlanX internal address for routing. I only had 1 layer 3 trunk for accessing the border router
    – Kendrick
    Oct 28, 2017 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.