cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1436
Views
0
Helpful
3
Replies

mac-address to ip address

Hi

we have a 3560 PoE switch and in one of the interface i am seeing more traffic ..how to find the ip address of the device connected to that interface

Karthik

3 Accepted Solutions

Accepted Solutions

Jon Marshall
Hall of Fame
Hall of Fame

karthikgopi wrote:

Hi

we have a 3560 PoE switch and in one of the interface i am seeing more traffic ..how to find the ip address of the device connected to that interface

Karthik

Karthik

It's a two step process.

1) On the 3560 switch enter this "sh mac-address-table interface ". This will give you the mac-address associated with that port

2) On the L3 switch/router  responsible for routing for the vlan that the device is in -

"sh arp | include "

Note the 3560  may or may be doing the routing for the vlan.

Jon

View solution in original post

Richard Burts
Hall of Fame
Hall of Fame

Karthik

It might help us to give a better answer if we knew whether your switch was acting as purely a layer 2 switch or whether you have configured it as a layer 3 switch and it is routing between VLANs.

Without knowing that I will phrase my answer in general terms so that it might apply to both situations.

First you should determine whether there is a single device connected on that switch port or whether there are multiple devices connected to that switch port. To do this execute the command show mac address-table interface . A single MAC listed indicates a single device and multiple MAC listed means multiple devices (and much more difficulty in identifying the source that you want).

Then you go to the device that is the default gateway for the subnet contained in the VLAN of the switch interface.

On the device that is the default gateway execute the command show arp. Look in the output for the MAC address from the switch interface and the IP address associated with the MAC address is the source of the traffic.

HTH

Rick

HTH

Rick

View solution in original post

The command "sh ip arp " will also have the same result as "sh arp | include ".

View solution in original post

3 Replies 3

Jon Marshall
Hall of Fame
Hall of Fame

karthikgopi wrote:

Hi

we have a 3560 PoE switch and in one of the interface i am seeing more traffic ..how to find the ip address of the device connected to that interface

Karthik

Karthik

It's a two step process.

1) On the 3560 switch enter this "sh mac-address-table interface ". This will give you the mac-address associated with that port

2) On the L3 switch/router  responsible for routing for the vlan that the device is in -

"sh arp | include "

Note the 3560  may or may be doing the routing for the vlan.

Jon

The command "sh ip arp " will also have the same result as "sh arp | include ".

Richard Burts
Hall of Fame
Hall of Fame

Karthik

It might help us to give a better answer if we knew whether your switch was acting as purely a layer 2 switch or whether you have configured it as a layer 3 switch and it is routing between VLANs.

Without knowing that I will phrase my answer in general terms so that it might apply to both situations.

First you should determine whether there is a single device connected on that switch port or whether there are multiple devices connected to that switch port. To do this execute the command show mac address-table interface . A single MAC listed indicates a single device and multiple MAC listed means multiple devices (and much more difficulty in identifying the source that you want).

Then you go to the device that is the default gateway for the subnet contained in the VLAN of the switch interface.

On the device that is the default gateway execute the command show arp. Look in the output for the MAC address from the switch interface and the IP address associated with the MAC address is the source of the traffic.

HTH

Rick

HTH

Rick
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco