how to find to which port pc is cnnected if you've IPaddress?

[peter.conings]

Hi, Have a Catalyst 2948. I have the ip address of a server which is infected. By which command can I see on which switchport this server is attached?

Show cam, sh mac.. I just can't find it...

Thx,

Peter

[marinos_g]

x.x.x.x -> IP address of server

yyyy.yyyy.yyyy -> mac address of server

1) Telnet to switch

2) Ping x.x.x.x

3) Show arp | include x.x.x.x (to see mac address of server)

4) Show mac-address-table | include yyyy.yyyy.yyyy

Sorry,

This is when using IOS.

I just remembered that 2948 is CatOS.

Try show arp.

[malik.boukraa]

hi,

I don't know the catalyst 2948, but i think it's a layer 2 switch & I don't you can find any layer 3 information on it.

You have to the "match" the IP address with the mac-address on a layer 3 by "sh ip arp" command for example. After, with the correct mac-address, you will be able to find the port where your server is.

Regards,

--

MB

Don't forget to rate...

[sstudsdahl]

The first thing you will need to do is get the MAC address of the server. You can accomplish this by looking at the ARP table of the router for the subnet that the server is on. You can narrow down the amount of info that you get with the command:

show arp | include

Once you have the mac address, you need to login to the Cat2948 and issue the command:

sh cam XX-XX-XX-XX-XX-XX

where XX-XX-XX-XX-XX-XX is the MAC address that was returned from ARP tables of the router. If this does not return the port that the server is connected to, you may need to ping it from the switch. It is possible that the CAM table entry can age out if there is no traffic to/from the server. I would guess that will not be the case here however since the server is infected with something.

Steve

[peter.conings]

Thanks all for your replies. Serverport found

[glen.grant]

This isn't really true , if you have a switch just hooked to one segment and the switch is not trunked , just ping the address and then do a show arp on the 2948 or any catos switch and it will tell you the ip address, the mac address and what port it is on . On a switch that is trunked it will not work though .