cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1379
Views
10
Helpful
2
Replies

Where is that switch

eigrpy
Level 4
Level 4

Hello, Usually mac address of PC can be left at switch port after the PC send some message to switch. But here is a little unusual. Here is a diagram, but not exactly: SW1 ----SW2----SW3----SW4---SW5(or more).... ---PC
There are a lot switches between SW1 and PC, like the above SW2, SW3 and SW4... The PC(10.1.1.2) can ping SW1(10.1.1.1). I post the diagram like above, but we are not sure how these SWs are connected to each other, most possible they are connected like full connection. Now we want to know which SW and which port the PC is connected to physically. But we know the PC is not connected to any SW from SW1 to SW5. We only can see the mac of the PC on SW1 and know the mac is located at the SW1 port connected to SW2. My question is what is a better way(simple and fast) to resolve the issue? Thanks

2 Replies 2

TJ-20933766
Spotlight
Spotlight

Provided these are all Cisco switches, this is how I would go about figuring out a topology in a new environment and determining the port a PC is on. The first step is not necessarily required but would be helpful for future troubleshooting moving forward especially if finding the switch port a PC is connected to becomes a regular occurrence.

1) Learn the Network Topology - Using Cisco Discovery Protocol provides you with the following information:

  • Hostname
  • IP address
  • Interface

Using this information, you can map out a network pretty much in no time. I typically use the commands as such:

show cdp neighbor

This will give you a view of any Cisco access points, phones, routers, and most importantly switches. Identify the interfaces that the switches are attached to and use them in the next command to reveal the IP address of the connected device:

show cdp neighbors g1/0/48 detail

Now that you have the IP address of the connected device, you can SSH/Telnet to it and start the process over again and again until you know about the whole topology. There are some paid tools out there that will do all this for you but this doesn't take all that long to do on your own.

2) Find the Switch Interface the PC is Connected to - SSH/Telnet into the router/layer3 switch that is the PC's default gateway. From there, ping the IP address of the PC. Lets say the IP address of the PC is 10.0.0.13:

3750X-Switch# ping 10.0.0.13
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.13, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/17 ms
3750X-Switch# show arp | inc 10.0.0.13
Internet  10.0.0.13               1   0022.4d9a.8f60  ARPA   Vlan1

You now have the MAC address of the PC.

Caution: do not try to ping the PC from any other device.

Note: You may need to ping the PC again every so often since the ARP table will timeout after 5 minutes.

Now use the following command to find the interface that the switch used to ping the PC:

3750X-Switch#show mac address-table address 0022.4d9a.8f60
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0022.4d9a.8f60    DYNAMIC     Gi1/0/48

Compare the interface with the "show cdp neighbors" result. If there is a CDP neighbor on that interface, then SSH/Telnet into that neighboring switch and search for the MAC address again using the command above. Continue this progress until you get to an interface that does not have a CDP neighbor attached to the interface. You have now found the switch & interface that the PC is connected to.

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello @eigrpy ,

L2 traceroute can help if supported

 

traceroute mac <mac-address> <mac-address>

 

However, the troubleshooting steps are as usual :

show mac address-table address <mac>

 

then you move to the next switch and you execute again the same command for the PC MAC address

 

show mac address-table address <mac>

 

show cdp neigh

can help you to find who is the switch connected to the switch port that has learned the MAC address.

Other possible tools you can use show spanning-tree to find out the topology of your switches.

 

Hope to help

Giuseppe