Tracking an ip or mac address to a switch.

[rsanders]

From the nachi virus I still have stations that have the virus. Besides turning off the hub switch, I can't quickly find the device. Is there a procedure or command to pinpoint a port on a switch that is broadcasting?

[cleroy]

I am sure it depends on the hardware but this works on 2900 and 3550 type switches.

- Ping the station doing the broadcast from the switch.

- Check the arp table to get the mac address corrsponding to the IP

- Check the mac table to find the interface.

Work your way up to the next switch if the interface you find is a trunk.

Hope it helps.

[milan.kulik]

You can also use l2trace command on CatOS switches.

Regards,

Milan

[glen.grant]

Must have at least 6.X code to run l2trace though .

[wsitu]

if these are cat switches, you can do "sho port mac" after you clear counters. identify which port is doing excessive broadcast.

Nachi will try to hit all of your networks. the other solution is have an acl on your router, and review the log. more solutions can be found on www.cert.org