You only know the IP address and you want to find out the port it is plugged in to.
Always start at the Layer 3 boundary of the subnet. Do a show arp to find the MAC address.
CORE1#sh arp | inc 10.142.3.2
Internet 10.142.3.207 11 0001.e67a.dc20 ARPA Vlan423
Internet 10.142.3.206 10 0001.e697.cbe6 ARPA Vlan423
Internet 10.142.3.254 - 0000.0c07.ac01 ARPA Vlan423
Internet 10.142.3.253 - 000d.662f.2980 ARPA Vlan423
Internet 10.142.3.252 0 000d.662f.2140 ARPA Vlan423
Internet 10.142.3.250 0 00c0.f044.5b72 ARPA Vlan423
If you do not see the device in the ARP Table (like above) you may need to ping it.
CORE1#ping 10.142.3.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.142.3.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
CORE1#sh arp | inc 10.142.3.2
Internet 10.142.3.207 11 0001.e67a.dc20 ARPA Vlan423
Internet 10.142.3.206 10 0001.e697.cbe6 ARPA Vlan423
Internet 10.142.3.254 - 0000.0c07.ac01 ARPA Vlan423
Internet 10.142.3.253 - 000d.662f.2980 ARPA Vlan423
Internet 10.142.3.252 0 000d.662f.2140 ARPA Vlan423
Internet 10.142.3.250 0 00c0.f044.5b72 ARPA Vlan423
Internet 10.142.3.2 0 000c.5502.1e62 ARPA Vlan423
CORE1#
Now we see the device and its MAC address. Now we need to find out where the core switch learned the address from.
CORE1#sh mac-address-table address 000c.5502.1e62
Legend: * - primary entry
age - seconds since last seen
n/a - not available
vlan mac address type learn age ports
------+----------------+--------+-----+----------+--------------------------
Supervisor:
* 423 000c.5502.1e62 dynamic Yes 80 Gi13/13
We can see that the switch learned it via VLAN 423 through interface Gi13/13.
Next we need to see what Gi13/13 is connected to.
CORE1#sh cdp neighbors gi13/13
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
DISTR-1 Gig 13/13 150 R S I WS-C4506 Gig 2/5
CORE1#
You can see from CDP that Gi13/13 is connected to switch DISTR-1. Next we telnet into that switch and look for the MAC address again.
DISTR-1#sh mac-address address 000c.5502.1e62
Unicast Entries
vlan mac address type protocols port
-------+---------------+--------+---------------------+--------------------
423 000c.5502.1e62 dynamic ip GigabitEthernet4/1
DISTR-1#
Again the switch learned the MAC on VLAN 423 via Gi4/1. We again look to see what is connected to interface Gi4/1.
DISTR-1#sh cdp neighbors gi4/1
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
ACCESS-SW23.wpsic.com
Gig 4/1 136 S I Cisco WS-CGig 0/2
DISTR-1#
We see that the MAC address was learned from switch ACCESS-SW23. Telnet into that switch and look for the MAC again.
ACCESS-SW23#sh mac-address-table address 000c.5502.1e62
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
423 000c.5502.1e62 DYNAMIC Fa0/27
Total Mac Addresses for this criterion: 1
ACCESS-SW23#
By looking under the Ports header we see that the access layer switch learned the MAC address from switch port Fa0/27. That's the switch and switch port the device is connected too, ACCESS-SW23 on port fa0/27!
Device Trace with CatOS
If you encounter a switch that is running CatOS, the command for finding the MAC address changes.
DISTR-2> (enable) sh cam 000c.5502.1e62
* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.
X = Port Security Entry $ = Dot1x Security Entry
VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]
---- ------------------ ----- -------------------------------------------
Total Matching CAM Entries Displayed =0
Here we see no entry for the MAC. We need to ping the IP address to get the MAC address in the ARP table.
DISTR-2> (enable) ping 10.142.3.2
!!!!!
----10.142.3.2 PING Statistics----
5 packets transmitted, 5 packets received, 0% packet loss
round-trip (ms) min/avg/max = 9/20/32
DISTR-2> (enable) sh cam 000c.5502.1e62
* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.
X = Port Security Entry $ = Dot1x Security Entry
VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]
---- ------------------ ----- -------------------------------------------
423 00-0c-55-02-1e-62 2/3 [ALL]
Total Matching CAM Entries Displayed =1
DISTR-2> (enable)
