2

Below is the "terminal monitor" output

%PM-4-ERR_DISABLE: security-violation error detected on Gi1/0/35, putting Gi1/0/35 in err-disable state

%AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet1/0/35, new MAC address (0800.2754.a0df) is seen.AuditSessionID Unassigned

After timeleft(sec) ends it is coming back; The problem is this keeps happening and I can not find this "0800.2754.a0df" and do not understand why this MAC tries to get assigned on this interface.

It is like this device tries to get assigned with my desktop's MAC Address, looks like a MAC address conflict.

#show errdisable recovery

Timer interval: 300 seconds

Interfaces that will be enabled at the next timeout:

Interface Errdisable reason Time left(sec)

Gi1/0/35 security-violation 183

It is happening on my desktop which has wired and wireless NIC. How can I find the IP of this MAC address? The switch is 2960x cisco.

Thanks

Improve this question
2
  • Not all MAC addresses are required to have an IP address in the sense you mean. Some could have an IPv4 address, and/or IPv6 could have multiple addresses and address types associated with the MAC address. There are other network protocols, too, although rare, that may be associated with a MAC address. Ethernet (MAC addressing) does not know or care which network protocol it carries in its payload, and neither does a network protocol care which data-link protocol carries it..
    – Ron Maupin ♦
    Commented Jan 13, 2023 at 13:25
  • So is the mac address the same as your desktop PC? Have you tried removing the security config on the port so that the device can be on the network long enough for it to get an IP address?
    – The Footsie
    Commented Jan 13, 2023 at 14:18

1 Answer 1

Reset to default
6

Generally to find the IP address associated to a MAC Address, the easiest way is to look in the ARP tables.
You can lookup in the the table of any device within the same (V)LAN but the device that is the most likely to have the info is the router that act as the gateway for this (V)LAN.

On most network devices, the command is either

show arp

or

show ip arp

Most routers can also refine the search, for example by VLAN with a command like

show ip arp interface vlan 100

Otherwise if you want to have a hint at what the device which own the mac address is, you can search for the mac address prefix in an OUI lookup tool. It will give you the manufacturer of the Network Interface Card (if this is a physical device) or the hypervisor vendor (if this is a virtual machine).

If the mac address in your post is the real one that bother you, the NIC is made by PCS Computer Systems GmbH, as can be seen by entering the mac address in the WireShark (no affiliation) OUI Lookup tool.
PCS Computer Systems sell building access controls and time management solutions, so this should allow you to narrow down your researches.

Of course the most efficient way is still to follow the physical path from the switch port.

Improve this answer
16
  • The device might also be using DHCP, so you could check the DHCP server for a lease with that MAC.
    – Zac67 ♦
    Commented Jan 13, 2023 at 12:43
  • I already did MAC address lookup but did not put in the question. Nobody knew about such a device. "show arp" cmd did not help either, could not find that MAC. thanks
    – hakkican
    Commented Jan 13, 2023 at 12:52
  • 2
    by experience the fact that nobody is aware of the existence of a specific device in the network doesn't preclude it from existing ;)
    – JFL
    Commented Jan 13, 2023 at 12:59
  • 1
    @hakkican It seems so but we don't have enough information about your network to be affirmative. I saw stranger things on some networks...
    – JFL
    Commented Jan 13, 2023 at 13:30
  • 1
    @hakkican You see the associated port in a switch's MAC table. Just follow the cable plugged into that port. No, there's no Ethernet traceroute as there's no TTL concept.
    – Zac67 ♦
    Commented Jan 13, 2023 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.