How to trace a Mac-address to an Ipaddress.

[alexadao]

Hello,

On Cat4006 I did: show cam dynamic 2/13.

I have the mac-address of a machine connected to that port. Now, I want to find out what is its IPADDRESS? I am trying to find out what IP is using the port 2/3, and the connected device is not a cisco product.

Thank you

--Alex Adao

[Georg Pauwen]

Hello Alex,

are you saying that your Layer 3 device is not a Cisco product ? Wether it is or not, or wether the product connected to port 2/3 is a Cisco device or not should not matter. The Layer 3 device must have a MAC-to-IP address mapping. With Cisco, the command ´show arp´ gives you the corresponding MAC-to-IP address mapping. Which manufacturer is the device from ?

Regards,

Georg

[alexadao]

Hello Georg,

what I was saying that the device connected to the 4006 port 2/13 is not a cisco device. It is a Digital Equipment(an old network card '08002B'). From the 4006,I couldn't trace the mac-addres to ipaddress. I had to access the 6509 and try to trace the ip from there. I could trace many mac-addresses, execpt this mac-address from Digital Equipment. It shows on the 4006(with command "show cam dynamic 2/13"), but when I tried to trace this mac-address from the 6509("show ip arp", or "show ip arp vlan x" it's not showing on the table. Niether with "show ip arp " May be it is because the NIC is really old...

[b-ulrich]

A few ways you can do this. Depending on where your layer 3 vlan resides for that switchport, ie, another core switch downstream from the 4006, just issue the command 'sh ip arp vlan X' and you can match up the IP address with the MAC. If the VLAN is very large and has alot of entries, you can issue the command 'sh ip arp xxxx.xxxx.xxxx' and it will return the IP address. Hope this helps.

[alexadao]

Thank you very much, it works. I went to another core switch downstream and map most of the mac-addresses to ipaddresses, except one that I don't know why. I know the vendor of that NIC or device, Digital Equipment and believe that whatever is it is, it is very old device, but thanks a lot.

--Alex Adao

[Georg Pauwen]

Hello Alex,

if you have your MAC address, check the following link for the corresponding manufacturer:

Vendor/Ethernet MAC Address Lookup and Search

http://compnetworking.about.com/gi/dynamic/offsite.htm?site=http://coffer.com/mac%5Ffind/

HTH,

GP

[milan.kulik]

Hi,

there is a nice tool Switch Port Mapper (a part of SolarWinds Engineers edition) which can do this task for you comfortably.

Regards,

Milan

[peter.mainwaring]

Just a thought.

Could the reason you cannot find an IP address associated with the MAC address be that the workstation isn't running IP? As it is an old DEC card, it may be running LAT or one of the other proprietory DEC protocols, in which case the MAC address would show up because the device is transmitting data, but if that data isn't IP there won't be an IP address to match it.

Pete

[milan.kulik]

In that case I'd trace the cable going from the interface, find the workstation physically and observer, what's running on it and how it is configured.

Another "spohisticated" (but time consuming) solution:

Configure a SPAN or RSPAN session on the port, capture some frames coming from the workstation, analyze them with a protocol analyzer and look at the L3 address in them.

Regards,

Milan