5

How to trace a MAC address on a switched LAN?

I want to be able to find out a switch port's MAC address.

  • No device uses IP, therefore no address resolution and no SNMP.
  • No device runs CDP, therefore no Cisco L2 traceroute.
  • No fancy tools on my laptop available.

Topology: There are 10 switches. One is in the center. It is connected to four other switches. Each of those four switches is connected to another switch. Each switch in the third row has three end devices attached. All devices are connected via switching port, except end devices which use their NIC. I cannot change the topology. But I can hang on to whatever device I want and change its configuration as far as I do not assign an IP address to a switch or enable CDP.

Firmware: Cisco Catalyst 2950-24 IOS C2950-I6Q4L2-M 12.1(22)EA4. That's the one Packet Tracer simulates.

Yes, I did read the question Locate a host on Network. This question may be answered with a simple no.

Improve this question
8
  • 1
    Your search-foo is lacking... look through the mac-address table of each switch to trace back where a specific machine lives. (i.e. look at the table on every "edge" switch)
    – Ricky
    Jan 13, 2014 at 22:38
  • 1
    @Ricky_Beam: Thank for your advice - haven't considered that yet! Definitely a more efficient approach. /// Cisco Catalyst 2950-24 IOS C2950-I6Q4L2-M 12.1(22)EA4. That's the one Packet Tracer simulates. /// This question may be answered with a simple no.
    – user2964971
    Jan 13, 2014 at 23:17
  • I'm not exactly clear what you're asking for when you say "I want to be able to find out a switch port's MAC address." Do you want to know the MAC address of the switchport itself? Or of a device connected to a particular switchport.
    – Brett Lykins
    Jan 14, 2014 at 0:04
  • 1
    @Brett_Lykins : I want to follow every MAC address on the LAN. I would like to trace a MAC as simple as an IP traceroute. However, I know that is implossible. I prefer pyatka's approach because it's the most efficient one.
    – user2964971
    Jan 14, 2014 at 10:43
  • 1
    I was forbidden to leave the project with any switch having an IP address. I was allowed to reset switches and configure them temporarily however I wanted. I could connect via console port. I did post the question because I wanted to know How to trace a MAC address on a switched LAN under these constraints.
    – user2964971
    Jan 17, 2014 at 19:43

3 Answers 3

Reset to default
9

If you have an end-to-end vlan topology, where vlans are not terminated on switches, you can use somethink like this algorithm:

On the root switch get the mac address table, use filter output:

sh mac add | i 8a06

1    0015.5d02.8a06   dynamic ip,ipx,assigned,other TenGigabitEthernet4/5

Now you know, that mac is behind interface TenGigabitEthernet4/5. Connect to the switch behind this interface, and repeat sh mac add | i 8a06. You will find your host in the end.

Improve this answer
0

in layer 3 you can use the below:

show mac-address table address i 5840.85128.sc48

Improve this answer
0

If you are aware of device ip address then we can process commands to get mac -address

In layer3 devices enter command

Assuming your device ip address is 192.168.X.X

Switch (config)#sh ip arp | I 192 .168.X.X

Output of command = mac address for specific ip address is showen

So further even we can find on which L2 interface this end device is connected by using commend

Layer3 device =Switch(config) # sh mac -address table | I aea.24a.xxx xxx.xx

Improve this answer
3
  • The question explicitly states “No devices use IP”
    – Teun Vink ♦
    Sep 22, 2020 at 16:05
  • If no devices uses ip mean you cannot trace devices
    – Sagar Uragonda
    Sep 23, 2020 at 3:41
  • I think you’re confusing tracing (finding out on which port a mac address is used) with the utility called traceroute.
    – Teun Vink ♦
    Sep 23, 2020 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.