Question about finding an IP address on a network

[darren849]

I was wondering if there is a simple way of tracking down what port an IP address lives on in a network.

I some times recive calls that an IP address on my network is flooding a virus out to another company. I have about 600 PC's in my cisco network and would like to know if their is an easy way of doing this.                  

[ttnaciscosupport]

look in dhcp for the IP address, find the corresponding MAC address.

then do a show mac address table xxxx.xxxx.xxxx

that will tell you the port that it is plugged into

[devils_advocate]

Assuming you have a Distribution > Access Switch topology.

Login to your distribution switch and ping the device.

#ping 10.1.1.1

Then look in the ARP cache to obtain the MAC address:

#show ip arp 10.1.1.1

Then look in the MAC address table for that MAC address to find which Access switch the host is connected to:

#show mac address-table | i 1234:5678:abcd

This should give you an outgoing port number which will be a link to one of your access switches. To find out which switch look at the CDP info for that port.

#show cdp neighbout Gi1/1

Once you know the Access Switch the host is connected to, login to that switch and look in the MAC address table again:

#show mac address-table | i 1234:5678:abcd

Assuming there are no daisy chained switches, the port which is shown in the MAC table should be the port your hos is connected to.

Cheers

[darren849]

Thank you very much for the response very good steps and it did help