find IP address/machine connected to a cisco switch port

[trackme]

hello,

I need to know which IP/device is connecetd to a cisco Switch port.

I can get the mac-address of that switch port using sh mac-add command, but with the mac address how can i find that which ip belongs to this mac.

is there way i can do this, i know i can do the other way meaning with IP i can find to which port its connected ,but dont know how to find this MAC to IP with switch without the need for additional tools

[walter baziuk]

Hello

i use the folowing two TCL file

the arp example answers your query. the other is also very usefull

reanme to .TCL and tftp to the flash drive on the router or switch

create an alias, see the file comment for an example 

NOTE, i did not create them. If you share them , please keep the orginal creator details in the file

if you like these , please vote and rate my comments

router#arp
IP address MAC address    Physical intf        Logical intf
========== ============== ==================== ===========
10.0.27.2  c464.13dc.faa0 GigabitEthernet0/3/0
10.0.27.7  001d.e622.0a38 GigabitEthernet0/3/0
10.0.112.1 f0f7.550f.0c60 GigabitEthernet0/0
10.0.112.2 c464.13dc.fa80 GigabitEthernet0/0
10.0.123.2 c464.13dc.fa81 GigabitEthernet0/1
10.0.123.3 f0f7.5523.b5f1 GigabitEthernet0/1
10.1.20.1  c464.13dc.fa83                       Vlan120

router#ipconfig
Interface                  IP Address    MTU State
==============================================================
Embedded-Service-Engine0/0 no address         admin down
GigabitEthernet0/0         10.0.112.2/24 1500 up
GigabitEthernet0/1         10.0.123.2/24 1500 up
GigabitEthernet0/2         10.0.24.2/24  1500 admin down
GigabitEthernet0/3/0       10.0.27.2/24  1500 up
GigabitEthernet0/1/0       no address         down

[Collin Clark]

http://packetpros.com/find-a-device-in-the-network/

[ivanlopez777]

have you tried to configured the dhcp snooping?

that would work and you can find the ip with the mac-add

look on cisco how to configure the dhcp snooping 

sh ip dhcp snooping binding interface 

[andrewx555]

Hello all.

Just resolved such an issue.

Go to L3 device where Interface Vlan is configured and do "debug arp".

All correctly configured devices usualy send ARP requests to discover IP-gateway. So this ARP-request should be seen in debug like this:

11:38:45: IP ARP req filtered src 10.154.39.12 f081.af80.31e8, dst 10.154.39.9 0000.0000.0000 wrong cable, interface Vlan2

"10.154.39.12" is what I was looking for.

[cyborgltd]

Hi everyone,

I just found a different way to get the information.

This assumes that you have IP tracking on and a switch that supports it. The 3850 does!

Enter:    show ip device tracking interface g1/0/4

Result:

--------------------------------------------
Interface GigabitEthernet1/0/4 is: STAND ALONE
IP Device Tracking = Enabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
IPv6 Device Tracking Client Registered Handle: 5
IP Device Tracking Enabled Features:
HOST_TRACK_CLIENT_SM
--------------------------------------------
10.2xx.2xx.xxx 20bb.c092.xxxx 524 GigabitEthernet1/0/4 30 ACTIVE ARP

[kakatiya]

sh ip device tracking all

[CSCO13030217]

Try  this command 

Sh ip dhcp sn b | inc xx/x/xx(your intrefast)

[ssyam17]

Hello,

to answer your question look the command below;

'sh ip dhcp snooping binding' ....this will show the ip bind to the certain port

'sh ip device tracking all' ... this also can get you the IP and mac address bind to the port number.

try this 2 should answer the question

[juniorx73]

Try this see if can help

Under the switch port ADD A LINE

ip device tracking maximum 10

Then in ENABLE mode (example to see the IP address connected to port 23)

sh ip dev trac int gi1/0/23
portDB has 1 entries for interface Gi1/0/23, 1 dynamic
Codes: L - Local, S - Static, ND - Neighbor Discovery, ARP - Address Resolution Protocol, DH4 - IPv4 DHCP, DH6 - IPv6 DHCP, PKT - Other Packet, API - API created
Preflevel flags (prlvl):
0001:MAC and LLA match 0002:Orig trunk 0004:Orig access
0008:Orig trusted trunk 0010:Orig trusted access 0020:DHCP assigned
0040:Cga authenticated 0080:Cert authenticated 0100:Statically assigned

Network Layer Address Link Layer Address Interface vlan prlvl age state Time left
ARP 192.168.119.133 2829.8680.5eef Gi1/0/23 119 0005 7s REACHABLE 307 s

[zaf.khan99]

Use the following command to get the IP address.

#sho lldp neighbors gigabitEthernet 1/5 detail
------------------------------------------------
Local Intf: Gi1/5
Chassis id: 706d.1505.e122
Port id: Gi0
Port Description: GigabitEthernet0
System Name: Office-39-WiFi

System Description:
Cisco AP Software, ap3g3-k9w8 Version: 17.9.4.27
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2023 by Cisco Systems, Inc.
Compiled Tue Jul 11 07:07:26 GMT 2023 by aut

Time remaining: 94 seconds
System Capabilities: B
Enabled Capabilities: B
Management Addresses:
IP: 10.206.197.219
Auto Negotiation - not supported
Physical media capabilities - not advertised
Media Attachment Unit type - not advertised
Vlan ID: - not advertised