I have a Cisco Nexus 5672 which only lists the management VLAN ARP records, when doing show ip arp vrf all yet we have many VLANs on this switch, but it doesn't have a IP in all the VLANs, only the management one.

Can I somehow 'sniff' the ARP responses on the various VLANs to learn where machines are connected on the downstream (layer 2) switches? Will this require a IP in each VLAN or is there a feature that I can enable to do this?

I've already enabled feature interface-vlan but this has made no difference.

  • 1
    While ARP requests are broadcast, ARP responses are sent directly back to the requester, so trying to sniff the responses is a problem. You could sniff the requests to discover, the information of the requester. – Ron Maupin Dec 6 at 15:23

ARP is only required if a device needs to know the MAC address of an IP address.

If the route between the IP address of the switch to some device is via a router (which it will be if you have a management LAN) then all the traffic will go via the router, and so you'll just the ARP entries for the router and any other directly-connected management devices.

It is possible to capture packets with a monitor port on switches, but it has many issues.

But if what you actually want is to find out which devices are where, perhaps

sw2#show mac address-table 
Flags: I - Internal usage VLAN
Aging time is 300 sec

    Vlan          Mac Address         Port       Type    
------------ --------------------- ---------- ---------- 
     1         00:13:19:4e:bc:1d      gi22     dynamic   
     1         00:20:6b:6c:25:70      gi28     dynamic   
     2         00:24:c4:1d:00:18      gi24     dynamic   
     2         00:af:1f:77:92:93       0         self    
     ...

will do what you want

Also, CDP will show you switch adjacency, which might be helpful for you.

show cdp neighbors

[EDIT] And additionally, as noted in comments, if you're mapping from IP addresses to switches, you can check at the gateways for the various hosts. Depending on your network, this might be one or many routers. Of course, the ARP mapping are in the routers, but the layer 2 information is in the switches. For automated collection, consider SNMP or quick-and-easy crontabs such as ssh router show ip arp and ssh switch show mac-address-table

  • I'm looking to find out the IP's of the devices connected to the level 2 switches... On the level 2 (Catalyst switches) I can do show mac address-table and get the port + the mac-address of the client(s) but obviously at layer 2 it doesn't know the IP address. I need to make that connection between mac address and IP address... – djsmiley2k Dec 6 at 14:35
  • I believe the vlans are routed on the nexuses, however this may not be correct, but I'm unsure how to find out where they ARE routed? – djsmiley2k Dec 6 at 14:36
  • 1
    @djsmiley2k, routing happens at the device configured as the default gateway of a host. If you look at a host configuration, you can find the default gateway, and the device with that address will be the router for that host. – Ron Maupin Dec 6 at 15:21
  • @RonMaupin good point, I thought the nexuses were doing the routing, but as they don't have IP's in the necessary vlans they can't be. Apologies for being an idiot! :D – djsmiley2k Dec 6 at 16:55
  • If you add @RonMaupin's point about needing to check the gateway to find out what device is doing the routing then I'll happily accept this answer, unless Ron wants to answer separately... ? – djsmiley2k Dec 7 at 12:55

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.