Obtaining Layer 2 MAC Address

[ShoreSempai]

I am working with a partner who needs the original MAC Address of devices on a subnet.  Current traffic is being forwarded from our core switch, but due to how Layer 2 works, the original MAC Address of the device is not forwarded when the traffic gets to the core switch (i.e traverses the subnet gateway).

I am wondering if there is any possible means to obtain the original MAC address of a device on a subnet?  I have spent hours looking at ARP, MAC Address Tables, CDP and other approaches.  I know there are vendors out there who are getting the MAC address of devices on subnets for asset fingerprinting, so I know it is possible - but cannot figure out how.

I am open to any approach that is practical and was hoping someone here would have some ideas or could point me in the right direction.  My hope is to find a solution that solves the issue while, if at all possible, being easy to deploy.

I am open to using an API or other approach - but I am new to this world and seems like my attempts all end in dead ends.

Truly appreciate your thoughts and ideas - thank you!!!

[balaji.bandi]

I am wondering if there is any possible means to obtain the original MAC address of a device on a subnet?  I have spent hours looking at ARP, MAC Address Tables, CDP and other approaches.  I know there are vendors out there who are getting the MAC address of devices on subnets for asset fingerprinting, so I know it is possible - but cannot figure out how.

is this device still connected to the network? once ARP Flushed you can not get that MAC Address ? until you are doing any DHCP reservation to get MAC Address? or internal track of reservation IPAM so on.

I

[ShoreSempai]

Hi -

Yes, in this scenario the device is still connected or would reconnect at some point.  More than likely, because this is a critical infrastructure environment the device would have a static IP although I would need to solve for both dynamic and static.

[balaji.bandi]

To find the MAC Address :

First, you need to get the IP ARP results from where Layer 3 residing on that network.

Then find where this MAC address learning from 

Login to the destination switch issue show mac add xxx.xxx.xxxx then you see the results where it connecting.

come to your issue - need to look any ACL or any routing issue 

I am working with a partner who needs the original MAC Address of devices on a subnet.  Current traffic is being forwarded from our core switch, but due to how Layer 2 works, the original MAC Address of the device is not forwarded when the traffic gets to the core switch (i.e traverses the subnet gateway).

[ShoreSempai]

Thanks but I am trying to do this in an automated fashion - where someone does not have to login into a system, but rather the CISCO system can provide the details either through an API or other means.

[balaji.bandi]

If you like to do automated fashion, you can use SSH, to do this, or is your devices support REST API ? what kind of environment you have with device models?

you can find many netconf, yang or rest api examples in devnet forumm

[ShoreSempai]

Actually I can do any of those - SSH or REST - I will check into the device forums and see what I can find.  THANK YOU!

[balaji.bandi]

until we know what is this device? what IOS code running, we are out of the option to suggest you for now.

[ShoreSempai]

The challenge is that this is for a variety of different environments - so there is no one device.  The goal is to provide the solution as a means to identify network assets and fingerprint them - we can use a combination of SNMP, CDP, LLDP but we were hoping that there was a simple way to use IOS or other means to query for the MAC Address Table.    We know others have done something similar, but it seems inefficient that we would need a different approach for each network device.

[paul driver]

Hello

---

@ShoreSempai wrote:
I am wondering if there is any possible means to obtain the original MAC address

---

Yes you can -  ping the device from the L3 core switch, then show the arp for that ip address -  sh arp | in x.x.x.x this will provide you with the original mac- address of the host.

You could then  from the core switch use the show mac address address xxxx.xxx.xxxx to trace the host down to the particualr switch and its switchport it resides on.

[ShoreSempai]

This is very helpful - if we can do this via an API or other means without being on the device it would be great.  Though one challenge is that many devices today are turning of ICMP requests I believe.  Thank you!

[Joseph W. Doherty]

Whatever device is the 1st L3 hop should have an ARP containing all the hosts using it, their IPs and MACs.

Many such devices, that would be such a 1st L3 hop, likely support SNMP, and, if so, I suspect you can obtain the ARP table contents that way.

Alternative approaches would also include such screen scraping console/virtual-terminal access or other more "advanced" API.  However, likely SNMP access would be more available or more uniform.