Something that often comes in handy is the ability to physically locate hosts on a large campus network from their IP address. This article assumes the device is correctly configured on the network.
The MAC address can be found in the ARP cache of the hosts default gateway. To find the default gateway you need to run traceroute from any host on the same network (tracert on windows) which will give you something like the following:
matt@host:~$ traceroute 10.10.10.10
traceroute to 10.10.10.10 (10.10.10.10), 30 hops max, 60 byte packets
1 10.0.0.1 (10.0.0.1) 2.598 ms 2.875 ms 3.363 ms
2 10.10.10.10 (10.10.10.10) 3.908 ms 4.684 ms 4.363 ms
If the host is running a firewall then the last line may just show stars.
Connect (telnet/ssh) to the last hop before the device itself and check the ARP cache for the device. Remember that ARP entries time out after 4 hours of inactivity, the traceroute will refresh it.
Router# show ip arp 10.10.10.10
Protocol Address Age(min) Hardware Addr Type Interface
Internet 10.10.10.10 2 001e.1234.4321 ARPA VLAN 10
This output is from an MSFC card so the interface is the VLANs SVI. You may get a physical interface so check the CDP neighbors to ensure a switch is attached and not another router, if it is the a router then connect to it and keep tracing the address until you find a switch or VLAN interface. If you can't find it then check the NAT setup.
You now need to hop onto any switch associated with the interface shown above (VLAN 10 in this case). You may need some local knowledge or a bit more CDP investigation to find a suitable device. You may already be on it if it's a 6500 in native mode.
2. Locate the STP root bridge.
If you are working on a nicely designed network with combined routing/switching devices (e.g. 6500) then chances are good you're already logged onto the STP root bridge for that VLAN.
If not then find the VLAN you need by running show mac-address-table address 001e.1234.4321
The commands needed here are:
show spanning-tree vlan 10
show cdp neighbors x/y
Check the spanning tree output, find the root port for that particular VLAN, check CDP neighbors for that port, connect to that device and repeat until you are sitting on the device that is the root bridge. It will either say clearly "this is the root bridge" or you'll be able to tell because the device MAC and root bridge MAC are identical.
3. On the root bridge follow the path to the MAC address.
In IOS/native mode use
show mac-address-table address 001e.1234.4321
In CatOS/hybrid mode use:
show cam dynamic 001e.1234.4321
or
show cam dynamic 00-1e-12-34-43-21
(the latter if it's really old CatOS and doesn't like new format MAC addresses)
This should give you a port, e.g. in IOS:
Router# show mac-address-table address 001e.1234.4321
vlan mac address type learn qos ports
------+----------------+--------+-----+---+--------------------------
10 001e.1234.4321 dynamic yes -- 2/6
or in CatOS the output looks like the following (if you get no output read the note at the end of this article):
coresw1> (enable) show cam dynamic 001e.1234.4321
* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.
X = Port Security Entry $ = Dot1x Security Entry
VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]
---- ------------------ ----- -------------------------------------------
10 001e.1234.4321 2/6 [ALL]
In this case the MAC is found on port 2/6. Assuming that isn't a copper port run "show cdp neighbors 2/6". Connect to that device and repeat this step until you get an answer pointing to a copper port.
You've now found the device!
Hopefully someone was thoughtful enough to either fill out the SNMP location field, the exec banner, the port description or to create a document telling you where on campus that switch is. It's now a simple matter to trace the cable and locate the device in question.
If you don't have any information beyond the switch name then it's time to start tracing cables and creating the documents yourself.
*note: CatOS will not show any output for "show cam dynamic 001e.1234.4321" if that MAC address is configured for port security on the local device as those addresses are not entered into the dynamic CAM table. In those cases you'll be able to find the port by running "show run | include 001e.1234.4321"
Posts
