How do you find which switch port a device with a given IP address is plugged into?
Show the answer
Say this first
On the gateway, show ip arp <ip> gives the MAC address. On the switch, show mac address-table address <mac> gives the port. If that port is an uplink, show cdp neighbors <port> detail or LLDP names the
next switch, and I repeat until the MAC appears on an access port.
Go deeper
Walking it
DSW1# show ip arp 10.10.0.57
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.0.57 3 3c52.8211.4a07 ARPA Vlan10
DSW1# show mac address-table address 3c52.8211.4a07
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 3c52.8211.4a07 DYNAMIC Gi1/0/1
Total Mac Addresses for this criterion: 1
DSW1# show cdp neighbors GigabitEthernet1/0/1 detail
-------------------------
Device ID: ASW3
Entry address(es):
IP address: 10.99.0.13
Platform: cisco C9200L-48P-4G, Capabilities: Switch IGMP
Interface: GigabitEthernet1/0/1, Port ID (outgoing port): GigabitEthernet1/1/1
ASW3# show mac address-table address 3c52.8211.4a07
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 3c52.8211.4a07 DYNAMIC Gi1/0/17
Total Mac Addresses for this criterion: 1The host is on ASW3 Gi1/0/17.
What else the table tells you
- The same MAC jumping between ports: a VM moving, or a loop (look for MAC flapping logs).
- Many MACs on one access port: an unmanaged switch, a phone with a PC behind it, or a hypervisor.
They will ask next
The ARP entry exists but the MAC is in no switch table. Why?
Cisco MAC table entries age out after 300 seconds by default, while ARP entries last 4 hours. A quiet host keeps its ARP entry but drops out of the MAC table. Ping it from the gateway to refresh the entry.
Traps
- Stopping at an uplink port. A MAC learned on a trunk only tells you which way to walk.
How did you do?Book 3.2 Switched Ethernet