Locating a Cisco Device on a Large Network

ryan.pulis1 · ‎08-05-2017

Hi All,

Having some trouble on a customer's large network, as there is a device with the MAC Address of 04:6C:9D:3C:E7:B1 with IPDT turned-on, which is causing Allen Bradley Ethernet cards to be bumped off of the network. Long story short, I could use some assistance in determining the location of this item that is causing the issue.

Is it possible that a MAC Address can be used to resolve the corresponding IP address?

Does Cisco have a table of MAC Addresses that may help resolve the model number of equipment?

I've had this problem before at another location where the IT Networking department was able to locate and remedy the issue quite rapidly:

https://supportforums.cisco.com/discussion/12563251/cisco-switch-upgrade-leads-allen-bradley-plc-duplicate-ip-address-errors

Thanks in advance!

Rob Cluett · ‎08-05-2017

This sounds like a good situation for "nmap".

Rob Cluett · ‎08-05-2017

You could also use the "show mac address-table" command but for a large network this may be too much work. Example below.

CTvSWT01#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    fa16.3e0a.bc5e    DYNAMIC     Po4
   1    fa16.3e20.6d4d    DYNAMIC     Po2
   1    fa16.3e2c.4115    DYNAMIC     Po4
   1    fa16.3e7a.0391    DYNAMIC     Gi0/3
   1    fa16.3e9c.8001    DYNAMIC     Po4
   1    fa16.3ea2.8001    DYNAMIC     Po4
   1    fa16.3ece.056d    DYNAMIC     Po2
   1    fa16.3ed3.8001    DYNAMIC     Po2
11    0000.0c07.ac00    DYNAMIC     Po4
11    fa16.3e2c.4115    DYNAMIC     Po4
11    fa16.3e76.4bd4    DYNAMIC     Po4
11    fa16.3ea2.800b    DYNAMIC     Po4
11    fa16.3eb2.c1c4    DYNAMIC     Po2
12    0000.0c07.ac00    DYNAMIC     Po4
12    fa16.3e20.6d4d    DYNAMIC     Po2
12    fa16.3e6c.9071    DYNAMIC     Po4
12    fa16.3e9a.8850    DYNAMIC     Po2
12    fa16.3ea2.800c    DYNAMIC     Po4

Rob Cluett · ‎08-05-2017

With nmap... note the reference to the lua script which uses snmp. I'm not sure it works since can't verify in my lab (snmp not running).

https://stackoverflow.com/questions/13212187/is-it-possible-to-get-the-mac-address-for-machine-using-nmap

Jon Marshall · ‎08-05-2017

Do you want find the IP address or the location of the MAC address ?

Either way start on your main L3 switch and then if mac address do -

"sh mac address-table address <mac address>" will show the port it is on which may be a link to another switch so go onto that switch and repeat until you find the port.

If you want know the IP on the L3 switch -

"sh arp | include <mac address>"

Jon