Plz Help

Unanswered Question
Jon Marshall Wed, 12/26/2007 - 09:58

Ali

As others have suggested, you need to track down the mac-address. So in your wireshark capture select one of the entries and

1) In the wireshark Gui go to the middle window and click on the + next to "Ethernet II, ...

2) Record the full mac-address. Note the mac-address not the IP address. As an example lets say the mac-address is

0008.02e1.832a

Note it may also be written as such

00-08-02-e1-83-2a

3) Log onto one of your 6500 switches and enter the following command

"sh mac-address-table address 0008.02e1.832a"

The output will tell you what port it is on.

4) If the port is an access port on the 6500 then you just need to find out what is attached to that port. if the port is a trunk port to another switch then you need to

5) telnet to that next switch and repeat the process ie. enter

"sh mac-address-table address 0008.02e1.832a"

Depending on your switch topology you may need to do this a few times until you find the correct switch. You are looking for a port configured as an access port.

As long as you have disabled ipv6 on all your network kit, assuming you don't need it, then it will very probably be a host PC. Follow the above to track it down.

Jon

hello Jon!

10xs for reply.but look command didn't works:

6509#sh mac-address-table dynamic fe80::9d58:ecda:bc:4dfd

^

% Invalid input detected at '^' marker.

6509#sh mac-address-table dynamic fe:80:9d:58:ec:da:bc:4d:fd

^

% Invalid input detected at '^' marker.

6509#sh mac-address-table add

6509#sh mac-address-table address 0218:411d:b301

^

% Invalid input detected at '^' marker.

6509#sh mac-address-table address fe:80:9d:58:ec:da:bc:4d:fd

^

% Invalid input detected at '^' marker.

Hello

6509#sh mac-address-table address 00:18:41:1d:b3:01

Legend: * - primary entry

age - seconds since last seen

n/a - not available

vlan mac address type learn age ports

------+----------------+--------+-----+----------+--------------------------

Supervisor:

* 199 0018.411d.b301 dynamic Yes 0 Gi1/7

* 197 0018.411d.b301 dynamic Yes 0 Gi1/7

what can i do now with this entry?

Jon Marshall Wed, 12/26/2007 - 11:58

Ali

What is on port gi1/7. If it is

a) another switch you now need to log on to that switch and repeat the process ie.

sh mac-address-table address 0018.411d.b301

b) a server/PC then you need to access that server/PC and disable ipv6.

Jon

Actions

This Discussion