Finding switch & port using MAC add

[Mohd Khairul Nizam]

Hi,

let say in the building of 6 level
level 6 is the core switch
level 5 - 1 is access switch

i need to find mac address of a PC ended with .ab01

i know the 'sh mac add-table | in ab01, it will show trunk port
how can i pinpoint to exactly the access switch & port of the PC ??

because when i see trunk port, i stuck and don't know how to move foward

maybe using the combo of cdp neigh detail??

Please help & suggest

[Julio E. Moisa]

Hi

You can use

show mac address-table | include <mac address or the last 4 values> ; (no arrows) it can point to the trunks so you can use show cdp neig <interface> details to find the IP of the next switch as you mentioned.

example: show mac address-table | include ab01

My recommendation is run it on the Core / Distribution switches first. You cannot find the PC directly unless you know the switch, so you need find it switch by switch starting from the Core. 

Hope it is useful

:-)

[Mohd Khairul Nizam]

Hi Julio,

Yes,that what I'm doing but at the core/distribution when i enter

show cdp neig details , it will show all the access switch for every floor (assume each floor more than 1 switch)

i still can't relate how to pintpoint to the exact access switch

unless i 'sh mac address-table | in ab01 on every acess switch

show cdp neig <interface> details : for the <interface>, which interface?

[Julio E. Moisa · Accepted solution]

Hi,

If you have executed the command show mac address-table | inc abcd on the Core switch it will show the port/interface where the MAC address is being learned so you can include that port/interface on the command below:

Imagine the show mac address-table | inc abcd provide that MAC is being learned through the interface g1/10

show cdp neig <port/interface> details 

example

show cdp nei g1/10 details  

[Mohd Khairul Nizam]

Hi Julio,

Thanks. i will need to test again & see the output

because, during my previous test , the output of show mac address-table | inc abcd = is gi2/0/49 ( this is at core)

and gi2/0/49 = is trunk port

i hv to give a try for 'sh cdp nei gi2/0/49 deta

[Mohd Khairul Nizam]

Yeah,

tested and got it.

[Reza Sharifi]

Hi,

At the core, you can use "sh ip ar | inc .ab01" this will tell you what vlan has that mac address and if you have vlans per floor, you can go to that specific switch for that floor and use "sh mac add-table | in ab01" and find the mac address.  If you have one vlan for all floors than you would have to go to every floor to find it.  The easiest way to do this is to use a free software called "switchmap" It inventory you switches once or twice a day (you can do more than 2 times if you want) and create a map of all the mac addresses, IP address, ports, descriptions, speed, duplex, etc.. You can than easily search for the mac address and find all the info you want about that port in less 30 seconds.

HTH

[mamin42618]

There is another situation associated to this topic; if someone knows the solution and like to share here;

well, I was reported an end user disconnection, with the ip address mentioned. My SRX could track the MAC address for me using sh arp | m a.b.c.d 

I tried to trace the Mac address at my core switch using sh mac address-tab | i 1234.5678.90ab

It didn’t return any entry

possibly host was down for a long time such as 10 mins or so and mac entry was updated meanwhile. 
My question is , in such situation, how can I figure out, which switch & port , the host is attached to? Coz I need to make sure the status of my physical port is healthy. Please advise, as per best of your experience. Thanks.