Using IP addy to find the port its connected to

[maybeimaleo]

When we had Enterasys switches I could go into command line mode and ping an address, then envoke the command arp -a. It would return all entries in the cache containing the address I just pinged plus what port it was plugged into.

Is there a command or a set of commands I could use on a Cisco switch?

I know that if I have the MAC Address I can find where it is connected; but what if I have a conflict on a static address? Since it doesn't show up in DHCP I have nothing to go on but the IP.

 

[jdeisenm]

to view the arp table do a
show arp
or if you know part of the ip address
you can do
sh arp | inc 0.1
to find
10.10.0.1

 

[KiscoKid]

You can do something similar on a Cisco switch utilising the 'show arp' and 'show mac' commands. Example follows

switch#ping 10.69.8.162

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.69.8.162, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/202/1004 ms
switch#sh ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.69.8.163 - 0015.2b31.f040 ARPA Vlan2
Internet 10.69.8.162 0 0003.a085.581c ARPA Vlan2
Internet 10.69.8.161 164 0011.212d.7d80 ARPA Vlan2
switch#sh mac-address-table
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
All 0015.2b31.f040 STATIC CPU
All 0100.0ccc.cccc STATIC CPU
All 0100.0ccc.cccd STATIC CPU
All 0100.0cdd.dddd STATIC CPU
2 0003.a085.581c DYNAMIC Fa0/4
2 0011.212d.7d80 DYNAMIC Fa0/1
3 000f.90ba.fe00 DYNAMIC Fa0/2
3 000f.90ba.fe01 DYNAMIC Fa0/2
3 0011.212d.7d80 DYNAMIC Fa0/1

Note you will only see local hosts (i.e. hosts that reside on same IP subnet) in the ARP cache for the switch. For any offnet ARP resolved addresses, the switch's default gateway will keep track of all the resolved MAC addresses.

 

[maybeimaleo]

Small problem though, when I do those command I do not get the mac address of the reporting nic. It looks like I get the MAC address of the switch itself:

switch#ping 10.18.24.255

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.18.24.255, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

switch#sh ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.124.10.201 - 0017.9493.d7c1 ARPA Vlan10
Internet 10.18.24.207 26 0012.7fbc.d27f ARPA Vlan10
Internet 10.18.24.255 89 0012.7fbc.d27f ARPA Vlan10

my mac is Physical Address: 000D.5696.EB23, so why does the above show 0012.7fbc.d27f?

 

[jdeisenm]

See the last paragraph of Kiscokids post. In other words, 24.255 is on a different subnet and is accessible by the interface with the mac address d27f.