mac-address to ip address

Answered Question
Mar 15th, 2010
User Badges:

Hi


we have a 3560 PoE switch and in one of the interface i am seeing more traffic ..how to find the ip address of the device connected to that interface



Karthik

Correct Answer by Leo Laohoo about 7 years 2 months ago

The command "sh ip arp " will also have the same result as "sh arp | include ".

Correct Answer by Richard Burts about 7 years 2 months ago

Karthik


It might help us to give a better answer if we knew whether your switch was acting as purely a layer 2 switch or whether you have configured it as a layer 3 switch and it is routing between VLANs.


Without knowing that I will phrase my answer in general terms so that it might apply to both situations.


First you should determine whether there is a single device connected on that switch port or whether there are multiple devices connected to that switch port. To do this execute the command show mac address-table interface . A single MAC listed indicates a single device and multiple MAC listed means multiple devices (and much more difficulty in identifying the source that you want).

Then you go to the device that is the default gateway for the subnet contained in the VLAN of the switch interface.

On the device that is the default gateway execute the command show arp. Look in the output for the MAC address from the switch interface and the IP address associated with the MAC address is the source of the traffic.


HTH


Rick

Correct Answer by Jon Marshall about 7 years 2 months ago

karthikgopi wrote:


Hi


we have a 3560 PoE switch and in one of the interface i am seeing more traffic ..how to find the ip address of the device connected to that interface



Karthik


Karthik


It's a two step process.


1) On the 3560 switch enter this "sh mac-address-table interface ". This will give you the mac-address associated with that port


2) On the L3 switch/router  responsible for routing for the vlan that the device is in -


"sh arp | include "


Note the 3560  may or may be doing the routing for the vlan.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Correct Answer
Jon Marshall Mon, 03/15/2010 - 11:01
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

karthikgopi wrote:


Hi


we have a 3560 PoE switch and in one of the interface i am seeing more traffic ..how to find the ip address of the device connected to that interface



Karthik


Karthik


It's a two step process.


1) On the 3560 switch enter this "sh mac-address-table interface ". This will give you the mac-address associated with that port


2) On the L3 switch/router  responsible for routing for the vlan that the device is in -


"sh arp | include "


Note the 3560  may or may be doing the routing for the vlan.


Jon

Correct Answer
Leo Laohoo Mon, 03/15/2010 - 14:23
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 LAN, Wireless

The command "sh ip arp " will also have the same result as "sh arp | include ".

Correct Answer
Richard Burts Mon, 03/15/2010 - 11:09
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Karthik


It might help us to give a better answer if we knew whether your switch was acting as purely a layer 2 switch or whether you have configured it as a layer 3 switch and it is routing between VLANs.


Without knowing that I will phrase my answer in general terms so that it might apply to both situations.


First you should determine whether there is a single device connected on that switch port or whether there are multiple devices connected to that switch port. To do this execute the command show mac address-table interface . A single MAC listed indicates a single device and multiple MAC listed means multiple devices (and much more difficulty in identifying the source that you want).

Then you go to the device that is the default gateway for the subnet contained in the VLAN of the switch interface.

On the device that is the default gateway execute the command show arp. Look in the output for the MAC address from the switch interface and the IP address associated with the MAC address is the source of the traffic.


HTH


Rick

Actions

This Discussion