Need to find mac address of switch port.

[mahesh18]

                   Hi all,

I am looking to find  the mac address of IP.

sh ip arp 172.34.x.xshows

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  172.34.x.x          -   000c.85f5.0ebf  ARPA   Vlan29

sh mac address-table address 000c.85f5.0ebf

Unicast Entries

vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

  27    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  29    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  37    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  38    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

107    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

156    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

254   000c.85f5.0ebf    static ip,ipx,assigned,other Switch

316    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

318    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

504   000c.85f5.0ebf    static ip,ipx,assigned,other Switch

514   000c.85f5.0ebf    static ip,ipx,assigned,other Switch

Need to know how can i go further from here

Thanks

Mahesh

[John Blakley · Accepted solution]

Mahesh,

You'll have to trace from here. You know that to get to this address, you'll have to go to vlan 29. What interconnected switches allow vlan 29 over the trunk? If you have 3 that connect to here and you allow this vlan over the trunk, you'll need to connect to each of those and ping the address. Do your show arp/show mac address, and eventually you'll come down to a port on a switch.

HTH,

John

[mahesh18]

Hi john,

So you mean only look for vlan 29 even though command show mac addess shows  it learns mac from various vlans?

Also i checked  vlan 29 it has several ports but none of them are trunk.

So you mean i need to check trunk ports on current switch and check if vlan 29 is allowed over the trunk and connect to nei switch right?

Thanks

Mahesh

[John Blakley · Accepted solution]

Mahesh,

You'll have to track down each switch that you have interconnected. If you have 3 switches, you'll telnet into each of them and ping this IP. Eventually, you'll get to a physical port number:

Switch #sh arp | inc 10.1xx.100.2xx

Internet  10.1xx.100.2xx          0   0050.56a4.22f0  ARPA   Vlan1

Switch #sh mac address | inc .22f0

*    1  0050.56a4.22f0   dynamic  Yes          0   Gi1/29

You'll need to do this on all of your switches until you find it. If you run into a situation that you find the mac address on a trunk port, you need to figure out what switch connects to that port:

Switch# sh arp | inc 10.128.100.75

Internet  10.128.100.75           0   5c26.0a7d.ea98  ARPA   Vlan1

Switch# sh mac address-table | inc .ea98

*    1  5c26.0a7d.ea98   dynamic  Yes          0   Gi2/48

I know that g2/48 connects to a stack of switches. I then repeat the process of pinging the address to get it in the arp table, and then match that mac up with the mac address table. The one problem that you may have is that if you're switch doesn't have the subnet physically on it, the switch will send the request to it's default gateway. You won't see it in your arp table necessarily which means you'll need to get the mac address entry from the core switch. Then you can come back to this switch to look up the mac address in the table. (The mac address will be in the table, but the ip may not be in arp cache.)

HTH,

John

[mahesh18]

Hi John,

Need to confirm below.

The mac address which  i was tracing is assigned to vlan  not any switch port.

As i can see  on switch this mac is assigned to all  SVI.

sh mac address-table address 000c.85f5.0ebf

Unicast Entries

vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

  27    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  29    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  37    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  38    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

107    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

156    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

254   000c.85f5.0ebf    static ip,ipx,assigned,other Switch

316    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

318    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

504   000c.85f5.0ebf    static ip,ipx,assigned,other Switch

514   000c.85f5.0ebf    static ip,ipx,assigned,other Switch

vlan 29

Vlan29 is up, line protocol is up

  Hardware is Ethernet SVI, address is 000c.85f5.0ebf (bia 000c.85f5.0ebf)

So we can say that this mac address is static and assigned to switch itself right?

sorry for causing the confusion.

Hope it makes sense.

Thanks

Mahesh

[John Blakley · Accepted solution]

Mahesh,

I guess I'm not understanding what you're looking for, so I'm a little confused. If the mac address is pointing to a local address, that means that the switch has the address that you're looking for. This could be a static, physically on the box, etc.

If you do a "show run | inc arp", do you get anything back? Also, do a "show run | inc mac"

John

[mahesh18]

Hi John,

when i run sh run | inc arp nothing comes back.

sh ip arp 172.x.x.x

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  172..x.x.x          -   000c.85f5.0ebf  ARPA   Vlan29

i was looking for address  000c.85f5.0ebf

When i did  sh int vlan on switch i see

Vlan29 is up, line protocol is up

  Hardware is Ethernet SVI, address is 000c.85f5.0ebf (bia 000c.85f5.0ebf)

  Internet address is 172.34.x.x

sh mac address-table address 000c.85f5.0ebf

Unicast Entries

vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

  27    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  29    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  37    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

  38    000c.85f5.0ebf    static ip,ipx,assigned,other Switch

so i was confirming with you that this is switchs internal mac address assigned to different vlans in the switch.

Thanks

Mahesh

[John Blakley · Accepted solution]

Mahesh,

Maybe this post will help:

https://supportforums.cisco.com/thread/2165000

This mac address is assigned to your EtherSVI. All of the SVIs that you have configured on the switch will have the same mac address. This is why you see the multiple vlans. I'm assuming that you have a svi for vlan 27, 29, 37, and 38. If you look at those mac addresses, you'll notice that they all share the same address. As the post before states, the protocols are the types of protocols this port can support.

HTH,

John

[mahesh18]

Hi John & Rick,

Many thanks for answering all the questions  in this post.

Things are much clearer now.

Regards

MAhesh

[Rick Morris · Accepted solution]

As John is saying the MAC you provided is a MAC of an upstream, or downstream, switch.

You need to go back in the network to find it, kind of like tracing a line from one end to the other.

If you do not know what the upstream, or downstream, device is you can check via CDP, assuming it is not turned off.

There really is not anything else to add to what John posted.  Follow his steps and you will find what you need.

John - good reply.