topic Re: Try to find the device with IP address in Network Security

Try to find the device with IP address

phugiay — Thu, 06 Apr 2023 13:14:52 GMT

I try to track down the IP, 10.12.33.135 on our network.

From server, I use arp -a to list the IP and Physical Address (also it is MAC address) and I get the MAC address from this IP

With PA or MAC Address I got, I look on our switches to track down the port that has MAC address by issue the command show mac-address-table but I could not find the MAC address even I can ping 10.12.33.135 from switches.

I try show ip arp vlan 10..

Did I miss something ?

Thank you

Re: Try to find the device with IP address

Flavio Miranda — Wed, 05 Apr 2023 23:33:25 GMT

If you can ping the device from the switch then run show ip arp first to make sure the mac address is correct. Then use show mac address-table to find which port it is.

Ideally you should ping from a core switch and then try to identify which access switch this IP is connect, if it is not in the core.

Re: Try to find the device with IP address

Kasun Bandara — Thu, 06 Apr 2023 00:45:53 GMT

try #Show ip arp in switch and find the MAC. then use #show mac address-table to find the MAC advertised port in switch and trace one by one. at some point you will find the MAC address connected interface. if this is virtual MAC in virtualized env, you will come towards host server and after that you need to find via VSwitch.

Re: Try to find the device with IP address

TotallyTodd — Thu, 06 Apr 2023 00:46:29 GMT

Show ip interface brief totally ?

Re: Try to find the device with IP address

phugiay — Thu, 06 Apr 2023 13:15:59 GMT

Let me repost again my post. I use that too but it didn't show the ip or the MAC address I am looking for.

Re: Try to find the device with IP address

phugiay — Thu, 06 Apr 2023 13:17:56 GMT

I got the MAC from the server but I didn't see it from switch. I can ping the IP from switch. I am sorry I didn't make clear on my post and I repost again.

Re: Try to find the device with IP address

phugiay — Thu, 06 Apr 2023 14:00:19 GMT

I found it. It is Po3, port channel. Not sure where is this port located.

show etherchannel summary to show the port

show cdp nei

I think I may got it.

Thank you