If the IP is in the same subnet that you are monitoring then you would need to check the cam table on the switch where the sensor is connected. The cam table matches the MAC Address to a switch port. You can then see what machine is connected to that switch port. (If that port connects to another switch, then you would have to then check that switches cam table).
To check the cam table on a Cat 6500 use the command "show cam dynamic".
To find the port for a specific mac address try "show cam "
If you are running switches other than the 6500 then you might need to read through their user guides to see what the equivelant command would be on those switches.
If the IP Address was from a different subnet, then the mac address likely belongs to a router. Use the same technique as above to find out the router. Once you've found the router through which the packets were routed, then you need to determine if the subnet for the IP in question is directly connected to that router.
If it is then login to the router and try the "show arp" command to see the mac address for the IP in question. You can then go and again use the cam table on the switch to try and find the switch port.
If the IP Address was from a subnet not directly connected to that rouer then you may also want to try the "show route" or "show ip route" commands to figure out what the other router's ip is. You would then need to connect to the other router and use "show arp" or "show ip route" depending on whether the subnet was directly connected to that router.
Continue using these techniques until you eventually find the switch port where the machine is attached, or your search leads out your internet connection.
