Ali
As others have suggested, you need to track down the mac-address. So in your wireshark capture select one of the entries and
1) In the wireshark Gui go to the middle window and click on the + next to "Ethernet II, ...
2) Record the full mac-address. Note the mac-address not the IP address. As an example lets say the mac-address is
0008.02e1.832a
Note it may also be written as such
00-08-02-e1-83-2a
3) Log onto one of your 6500 switches and enter the following command
"sh mac-address-table address 0008.02e1.832a"
The output will tell you what port it is on.
4) If the port is an access port on the 6500 then you just need to find out what is attached to that port. if the port is a trunk port to another switch then you need to
5) telnet to that next switch and repeat the process ie. enter
"sh mac-address-table address 0008.02e1.832a"
Depending on your switch topology you may need to do this a few times until you find the correct switch. You are looking for a port configured as an access port.
As long as you have disabled ipv6 on all your network kit, assuming you don't need it, then it will very probably be a host PC. Follow the above to track it down.
Jon
