Good morning,
How do I find out which port on a Cisco switch is connected to a particular MAC address? I recently took over Network Administrator position and trying to clean up and organize. Thank you for your help :)
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin♦ Dec 25 '18 at 9:45
On most Cisco switches the command is:
sw1#show mac address-table
Aging time is 300 sec
Vlan Mac Address Port Type
-------- --------------------- ---------- ----------
1 00:0b:d6:25:f0:0f gi23 dynamic
1 00:13:19:1e:ac:8d gi28 dynamic
1 00:18:b9:2f:e3:87 gi12 dynamic
...
If you're tidying up switches, you might also find the Cisco Discovery Protocol (and similar LLDP) very useful:
sw1#show cdp neighbors
Device ID Local Adv Time To Capability Platform Port ID
Interface Ver. Live
------------------ ----------- ---- ------- ---------- ------------ -----------
sw2 gi28 2 129 S I Cisco gi28
SG300-28PP
(PID:SG300-2
8PP-K9)-VSD
...
If you're using a switch by web interface, look on menu for "MAC Address Table > Dynamic Addresses". For CDP it's under "Administration > Discovery (CDP) > CDP Neighbor Information". (Or matching LLDP if using that instead of CDP.)
It depends on the switch model, but on an IOS based switch the command is
show mac address-table address xxxx.xxxx.xxxx
Example:
show mac address-table address 0000.5e00.0102
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0000.5e00.0102 DYNAMIC Te1/0/2
Total Mac Addresses for this criterion: 1
The command show mac address-table will output the entire mac table.
Use these:
show cdp neighbor
show mac address-table
show ip arp
show cdp neighbor
This will show you other Cisco devices (Switches/Routers/WAPs/Fibre Switches) connected to the switch, tell you on which port they are connected to the switch, what their remote device name/IP are, and what model they are, and on what interface on the remote device they connect to that port on.
show mac address-table
This will show the MAC addresses to the ports, and is somewhat useful as you can use utilities to find the manufacturers, and you can get that info from the other devices individually.
However if you have portchannels/trunks you'll want to figure out where they connect to and check those devices again.
show ip arp
This will save you a TON of time, so long as you have an IP address configured on the switch for each VLAN that it contains for the local network there you can see what IPs in that network match what MAC addresses from the previous command.
Ie. this spits out a list of IP addresses to MAC addresses to VLANs.
You can easily use Excel to map the ports that have MAC addresses found in show mac address-table to the IPs that match the MAC addresses from show ip arp
Add in that if you're in a domain you can get the dnz zone file and match the IPS.
In a Windows Environment you can easily run DNSCMD on your Domain controller to quickly output a list of FQDNs to IPs and you can list most of your infrastructure by name to port.
