1

I have a Cisco 2960 switch that I'm trying to find which device IP address is connected to each port...

My Setup:

monitor session 1 source interface gigabitethernet 0/5
monitor session 1 destination interface gigabitethernet 0/37 ingress vlan 60

I plugged my Laptop to port 37 and fired up WireShark to capture the packets

I'm getting many packets with different source IP addresses, how can I find out exactly which device is plugged into this port?

also, port 5 is part of vlan 60, I've also tried:

monitor session 1 destination interface gigabitethernet 0/37 ingress vlan 60
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 4:24
2

There could be many devices on the other side of that interface. You can use the show mac address-table interface <switchport> command to see the MAC addresses of all the devices sending frames into the switch on that interface.

For example, you could have a hub, switch, or WAP connected to that interface, and you will see all the MAC addresses of the hosts on those other devices that send frames into the switch on that interface.

The switch does not know or care about the IP addresses of the hosts; it only concerns itself with the frames, which are addressed by MAC address. There are several ways to relate the MAC and IP addresses. For example, you could look in the ARP (resolves IP address to MAC address) cache of your host or the router.

4
  • Ah I see, so it's very possible there is another Switch on the other side and that's why I'm seeing all that traffic going through... if I have the MAC address that I got from the command above, anyway I can find the switch IP address so I can remote into it? ty – user1245735 Jun 19 '19 at 17:22
  • Switches are transparent devices, and they do not alter the frames (except to add and remove VLAN tags on trunks). You can use CDP to see if another Cisco device is connected to an interface, e.g. show cdp neighbors interface GigabitEthernet 0/37. It is likely that a switch has its management interface on a different VLAN than is configured on your switch interface. – Ron Maupin Jun 19 '19 at 18:50
  • ok great, thank you so much! Resolved :) – user1245735 Jun 19 '19 at 19:40
  • If I answered your question, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Jun 19 '19 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.