I have a question, there is a devic

[rn4it]

I have a question, there is a device that is sending syslog messages, to an old ip address of a syslog server. The Firewall is dropping them, I'm not sure where this device is located, but want to hunt it down. In extreme switches I can do this by seeing which port it's coming though, providing I have the MAC address. Is there a similar way to do this with cisco routers?

thanks

 

[thethmon]

Do you have the MAC address or IP Address of the device? If you have the IP address, you can do a 'show ip route x.x.x.x' and it will tell you what port the router uses to access that device. If you only have the MAC address, you can do a 'show ip arp | include xxxx.xxxx.xxxx' where xxxx.xxxx.xxxx is the MAC address. This will give you the IP address of the device and the port that the router sees it on. Todd Hethmon
thethmon@hethmon.com

 

[rn4it]

Thanks, I acutually came across the sh ip route, a little while ago, but this is will be helpful for the future.
thanks again