Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

find IP address/machine connected to a cisco switch port

Unanswered Question
Apr 1st, 2006
User Badges:


I need to know which IP/device is connecetd to a cisco Switch port.

I can get the mac-address of that switch port using sh mac-add command, but with the mac address how can i find that which ip belongs to this mac.

is there way i can do this, i know i can do the other way meaning with IP i can find to which port its connected ,but dont know how to find this MAC to IP with switch without the need for additional tools

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.8 (16 ratings)
pkhatri Sat, 04/01/2006 - 01:10
User Badges:
  • Purple, 4500 points or more


As you have discovered, there is really no easy way to discover the IP address of the device connected to a port.

As you indicated, you can get the MAC address of the device by using the 'show mac-address-table' command. Once you have done that, you can do one of two things:

- if the switch is a L3 switch, issue the command 'sh ip arp' to see if the MAC address is one that has been resolved recently. In that case, the IP address associated with that MAC address is the IP of the device connected to that port

- if the switch is not a L2 switch, go to the router that does inter-vlan routing and issue the command 'sh ip arp' to see if the MAC address is one that has been resolved recently. In that case, the IP address associated with that MAC address is the IP of the device connected to that port.

Pls do remember to rate posts.


trackme Sat, 04/01/2006 - 04:35
User Badges:


thanks for your answer,

as you know the ip arp table will have entries when either that ip is pinged or using routing actions as its a layer 3 function.

i have seen the arp table will show only when u ping the ip, so in this case i dont the ip and its really difficult some times who is connected to that switch port.

i have seen tools which will convert mac to ip, but i want to know whether within the switch is it possible or not.

johgill Sat, 04/01/2006 - 08:20
User Badges:
  • Bronze, 100 points or more

The mac address will not yield the IP address. You can track the port down and once you do that, look at the ARP table for that segment.

"show ip arp | include "

If it is not there, then it is not an active host talking to other networks.

trackme Mon, 04/03/2006 - 23:50
User Badges:


thanks for your reply. I have seen in many cases where only after i ping a certain device, it gets in to the arp table , belive me :)

so when i dont know the ip address and also that mac address not in the arp table how can i find that which device is connected to that port.

for example in my switch, i have some more than 30 devices conected to it, but when ever i issue a show arp command, i can see only two or three devices in the arp table.

if i ping an ip which is not in the arp table and check again for the arp table, this new entry will be there.

so in this kind of situation how can i find an ip/device with mac address only.

johgill Tue, 04/04/2006 - 03:40
User Badges:
  • Bronze, 100 points or more

Can you make sure to show ARP on the L3 gateway of that network?

If you are saying that this is the case, then you probably do not have an active host. A subnet broadcast may help here if it responds.

glen.grant Sat, 04/01/2006 - 05:10
User Badges:
  • Purple, 4500 points or more

If the switch is not trunked to a layer3 device , (single vlan ) sometimes you can get it by pinging the broadcast address of the subnet from the switch and then look in the arp table on the switch itself , in a trunked situation this will not work .

halcanites Wed, 05/22/2013 - 09:50
User Badges:

Has anybody else used this ccgetmacaddress tool?  I downloaded a 15 day trial and kinda like it.  Only concern is that I found that this company is in China.

amit-singh Tue, 04/04/2006 - 00:25
User Badges:
  • Blue, 1500 points or more

You can also download a freeware tool, ccgetmacaddress, with this tool you can get the IP to MAC or MAC to IP.

I have used it many times, it works :-)

HTH, Please rate if it does.

-amit singh

trackme Tue, 04/04/2006 - 04:42
User Badges:

i was already using that tool as i was mentioning in the posts that i can find with external tools :)

,but the issue is that this software will find that only when you specify an ip address in that range , for example u need to specify a range in your network.

Also its not freeware i think as mine expired in 14 days, is that really free since its very good tool for every one i guess.

miller811 Thu, 06/21/2012 - 14:33
User Badges:

Lots of good advice already, but you need to follow the process. Get the MAC address associated to the port. From the switch determine the VLAN, from the vlan determine the IP broadcast for the vlan. Ping the broadcast address for the L3 device and then show arp | in mac address to get the answer 

masquerade Thu, 07/19/2012 - 01:38
User Badges:

I'm late into this thread - but it looks as though this will help me.  I have dozens of switches of various ages split across a number of geographically separate locations - each location joined by a third-party WAN provider so that I don't have access to the routers.  Each location has a different sub-net.  I am looking to trawl the network looking to see what equipments are connected to which port of each switch.  There will be a mix of printers, laptop and desktop PCs - with a small number of servers.  The printers and servers will mostly have static IP addresses. The desktop PCs will use DHCP but will be (in effect) static.  The laptops will go from site to site and so from switch to switch.

Most switches are L2.  Trawling is done using a "home-coded" SNMP-based application so I can amend this as required.  I have the IP address and SNMP community strings for each switch.

I already have a tool (SolarWinds IP address tracker) that pings each address in each subnet on a regular basis so enabling me (for example) to spot unused addresses.  So I presume that the ARP table of each switch will have the MAC and IP address associated with each port - especially if I run the "address tracker" just before I do my "trawl".

So - is my process valid?

a) Run the IP address tracker

b) use SNMP to access the ARP table to extract IP and MAC of the device attached to each port


masquerade Thu, 07/19/2012 - 08:51
User Badges:

Alessio - many thanks - very much apreciated.  Chris

LAAsm2012b Wed, 10/17/2012 - 11:37
User Badges:

sh cdp nei det           

this CLI only shows cisco devices that connect to the switch, won't show any non cisco devices.

juan_diego_rodriguez Mon, 09/17/2012 - 15:06
User Badges:

Hi Trackme You can use the following command 'show ip arp' to see if the MAC address is  one that has been resolved recently, also you could use "show cdp neighbors detail" and see the type of device, ip , mac address and timers

If this answer was satisfactory for you, please mark the question as Answered.

Thank you

IT Dept Fri, 09/28/2012 - 02:13
User Badges:


     Am too late to this post. If you want to find IP connectd to a specific Port enable TP Tracking in your swicth and run,

"sh mac address-table". This will give which MAC is connected to which port.

"sh ip device tracking interface gigabitEthernet ". This will give which IP is connectd to a port.

"sh ip arp" will give you a IP to MAC table

LAAsm2012b Wed, 10/17/2012 - 11:40
User Badges:

what about the switch doesn't support sh ip dev tra CLI?

ashirkar Tue, 10/02/2012 - 02:56
User Badges:
  • Gold, 750 points or more

Hey Anantha ,

Hop u r doing good,

If u dont know ip address of devices present on specific vlan and wanted to track end device ip address please try

follow this below

steps 1:ping it to brodcast ip address of subnet

for ex






So u r brodacast ip is


Sending 1000, 100-byte ICMP Echos to, timeout is 2 seconds:


Reply to request 8 from, 28 ms

Reply to request 9 from, 64 ms

u will get reply from all host present on that segment and ur arp table will get flood with ip and respective mac on

your L3 device...(R1 in this example)

Step2: then u can use command

sh ip arp ..to see ip and respective mac associate with it

R1#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet                 -   c000.2498.0000  ARPA   Vlan2

Internet                 0   c003.2498.0000  ARPA   Vlan2

Step3: see the mac learned from specific port

R1#sh mac address c003.2498.0000

Destination Address  Address Type  VLAN  Destination Port

-------------------  ------------  ----  --------------------

c003.2498.0000          Dynamic       2     FastEthernet1/1

Step4:If  u have all cisco devices then u can use CDP

to check wht device connect to ur interface

R1#sh cdp ne fa1/1 detail


Device ID: SW1.lab.local

Follow this way, hop u will trace devices present on ur network

Hop this informative,


Ashish shirkar

rajeev_k_ranjan Sun, 10/14/2012 - 22:03
User Badges:

Hello trackme,

Is this question still on? Have you got answer for what you were looking? IF so, please post it here and mark it answered.

If not, i would like to thank you for asking such question and thank you everyone for posting all the relevant answers. I was too looking if we can track IP of a device using MAC or interface known.

I tried everything mentioned above but, hard luck. Nothing worked. Finally, i tried this to track IP which worked for me:

sh ip dhcp snooping binding interface gig 1/0/2 ---if you know the interface

sh ip dhcp snooping binding mac XXXX.XXXX.XXXX ---if you know the MAC

Assuming that DHCP snooping is enabled.

or sh ip source binding

or sh arp | in xxxx.xxxx.xxxx

Hope, this helps you as well.



walter baziuk Mon, 01/07/2013 - 22:14
User Badges:

the best answer seems to be

log onto the rtr or gateway device

ping the broadcast addreess of the vlan in question

sh ip arp

all devices with an ip will respond and be visble in the arp table

note, some devices "may" not respond. they are designed that way , for specific reasons

paolo bevilacqua Thu, 05/23/2013 - 02:27
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

all devices with an ip will respond and be visble in the arp table

note, some devices "may" not respond. they are designed that way , for specific reasons

Actually, only Cisco routers respond to pings to the broadcast address. PCs and other endpoints do not. So it a technique of limited use.

Bhautik.Trambadiya Wed, 02/20/2013 - 06:36
User Badges:

If you have Mac Address than , login to your cisco l3 switch which is connected to L2 Switch ,

In Cisco L3 Switch Type # sh ip dhcp binding assigned . here u need to find exact mac address which is might be start with 01 or 11 . thats it , there only u will find ip address which is associated to relevent Mac address.

othere than u can also enable cdp discovery in switch and type #sh cdp nei details

Ravi Singh Tue, 05/28/2013 - 19:55
User Badges:
  • Cisco Employee,

You can use the below command to check the ip address of devices

"show ip arp | include "


show cdp neighbors detail | begin MACADDRESS

cyborgltd Tue, 12/01/2015 - 09:39
User Badges:


I know your answer is 3 years old but I think your information would be a great asset to me as I am just starting out with Cisco devices in a very large environment. The URL you reference no longer exists. If your'e still around could you repost a valid link?

Thanks so much.

Jeffrey Weller 

Network Administrator 

walter baziuk Tue, 12/01/2015 - 10:19
User Badges:


i use the folowing two TCL file

the arp example answers your query. the other is also very usefull

reanme to .TCL and tftp to the flash drive on the router or switch

create an alias, see the file comment for an example 

NOTE, i did not create them. If you share them , please keep the orginal creator details in the file

if you like these , please vote and rate my comments

IP address MAC address    Physical intf        Logical intf
========== ============== ==================== ===========  c464.13dc.faa0 GigabitEthernet0/3/0  001d.e622.0a38 GigabitEthernet0/3/0 f0f7.550f.0c60 GigabitEthernet0/0 c464.13dc.fa80 GigabitEthernet0/0 c464.13dc.fa81 GigabitEthernet0/1 f0f7.5523.b5f1 GigabitEthernet0/1  c464.13dc.fa83                       Vlan120

Interface                  IP Address    MTU State
Embedded-Service-Engine0/0 no address         admin down
GigabitEthernet0/0 1500 up
GigabitEthernet0/1 1500 up
GigabitEthernet0/2  1500 admin down
GigabitEthernet0/3/0  1500 up
GigabitEthernet0/1/0       no address         down

ivanlopez777 Thu, 06/26/2014 - 07:06
User Badges:

have you tried to configured the dhcp snooping?

that would work and you can find the ip with the mac-add

look on cisco how to configure the dhcp snooping 

sh ip dhcp snooping binding interface 

andrewx555 Thu, 12/31/2015 - 00:59
User Badges:

Hello all.

Just resolved such an issue.

Go to L3 device where Interface Vlan is configured and do "debug arp".

All correctly configured devices usualy send ARP requests to discover IP-gateway. So this ARP-request should be seen in debug like this:

11:38:45: IP ARP req filtered src f081.af80.31e8, dst 0000.0000.0000 wrong cable, interface Vlan2

"" is what I was looking for.

cyborgltd Mon, 01/04/2016 - 06:58
User Badges:

Hi everyone,

I just found a different way to get the information.

This assumes that you have IP tracking on and a switch that supports it. The 3850 does!

Enter:    show ip device tracking interface g1/0/4


Interface GigabitEthernet1/0/4 is: STAND ALONE
IP Device Tracking = Enabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
IPv6 Device Tracking Client Registered Handle: 5
IP Device Tracking Enabled Features:
10.2xx.2xx.xxx 20bb.c092.xxxx 524 GigabitEthernet1/0/4 30 ACTIVE ARP


This Discussion