0

I have been working on this project and I have come to a point where I need to block the user in the network(At most in the CISCO switch)

I know I can send port shut via telnet session with a premade command but my problem is getting the users port.

I have only his IP Address for identification, is it possible to dump or get all the addresses in that switch? via telnet or?

Improve this question

2 Answers 2

Reset to default
3

Go to the router for that subnet and find the MAC for that IP -- if they're generating traffic, the router will have the MAC. Then go to each switch with access ports for that subnet (could be a single switch, could be dozens) and look for the MAC in the mac-address-table.

-- Example --

I have forgotten the port for the management interface of my iSCSI SAN switch, but I know the IP. From a machine in the same LAN, I ping it and then look in the ARP table:

[root:pts/5{4}]machine:~/[01:53 PM]:arp -a | grep IP
? (IP) at d0:7e:28:d1:42:01 [ether] on eth0

I first login to sw-r2-3:

sw-R2-3#show mac address-table address d07e.28d1.4201
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  55    d07e.28d1.4201    DYNAMIC     Po1

I know Po1 (port-channel 1) is the uplink for that switch, so I go to sw-r2-2:

sw-R2-2#show mac address-table address d07e.28d1.4201           
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  55    d07e.28d1.4201    DYNAMIC     Gi1/0/43

I know G1/0/43 is an access port -- show run int g1/0/43 -- so that's where it's connected.

Improve this answer
4
  • Ah so its more of I need to access the router to get what I wanted. thank you will try this approach :)
    – Franz Justin A. Buenaventura
    Jun 28, 2014 at 0:01
  • Note: "router" could also be a switch. In my example, all the switches are layer-2 devices (they don't do any routing) as such, they have no layer-3 (IP) information. (other than management traffic)
    – Ricky
    Jun 28, 2014 at 0:14
  • Is it possible to contact the router from a an access point in the switch? via telnet or something similar? Also I assume this is possible with ipv6? =)
    – Franz Justin A. Buenaventura
    Jun 28, 2014 at 2:13
  • layer-2 (MAC) doesn't care what your layer-3 (IP, IPv6, IPX, etc.) is. It only changes the first step: finding the MAC. For linux, that's ip -6 neigh.
    – Ricky
    Jun 28, 2014 at 5:56
0

You can try ARP'ing for the MAC address and find out which machine it belongs to. Checking the ARP table on the switch can also help.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.