Tracing physical location of IP address in network using switches
Home > Switch configuration notes > Tracing physical location of IP address in network using switches
To trace where is particular IP switch port by switch port we can make use of two different types of tables stored in switch:
- IP / ARP table
- MAC address table
From IP / ARP table we can find our MAC address of the PC that we are looking for. Even if the MAC address is spoofed this is the address that is being advertized by IP address we are interested in. Once we have found the correct MAC address we can on which port switch will forward the traffic destined for that MAC address.
To see ARP tablei on Cisco switch
Command to see IP / ARP table is
show ip arp
To filter output only for particular IP use
show ip arp | include <ip_address>
To see MAC Address table on Cisco switch
Command to see MAC address table in advanced switches like (3750) is
show mac address-table
and to see the same in normal switches like 2950 is
show mac-address-table
Here also we can use '| include' to display on MAC address we are interested in.
Note that Linksys switches which are usually configured through web interface also allow administrator to see MAC address table to help in determining location of an MAC address on a switch port. In such cases one can look for ARP entry on main L3 switch to find out interested machines MAC address and then use MAC address table of linksys switch to find out actual port'
Home > Switch configuration notes > Tracing physical location of IP address in network using switches
