CEF question

[namishkumarsharma]

We have a site and on that site we have a server which is down form  last two days. However , to manage these devices we are not using any  tools. We are not able to find this server that where it is located and  on which switch it is connected to.

I want to know that the timer for mac address is 5 minutes and arp timeout is 4 hours .

Is there any way to find out the mac address of the server ...

I  feel like this can we done with the help of cef ? Is it true or not I  am not sure. I am running 3750 stacks and 2811 routers. 3750 stacks are  working as layer 3 devices.

They are also running the pretty new IOS 12.2(53)SE.

According to my understanding npow days CEF entry does not expire if we are not using them.

The remain in cache as we are runnign with destination base CEF. Please suggest :- (

[Giuseppe Larosa · Accepted solution]

Hello Namish,

no you cannot use the CEF table  to retrieve that  information after two days

I'm sorry to give you bad news

you need to examine the syslog server log files and to find out what switch ports have gone down two days ago then when you have a list of ports you can check them one by one.

Hope to help

Giuseppe

[namishkumarsharma]

Thanks Giuseppe for a prompt response.

I have one more questions. In my case we are searching server after two days.

When do cef entry expires for a destination. when arp time-out or after some time ????

Is there any exact value for it ??

[Giuseppe Larosa · Accepted solution]

Hello Namish,

the information about a directly connected host is actually taken from ARP table

in other words we could say that CEF uses the ARP table  to prepare packet rewrite info for directly connected hosts ( in the IP subnet)

So you cannot expect the CEF info to last more then the ARP entry just to say

Hope to help

Giuseppe

[namishkumarsharma]

Thanks a lot for the answer. I really appriciate :-)