Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Isolating a mac address

I have a rogue DHCP machine and have used Windows "dhcploc" tool - along with Ethereal - to track down both the ip address and mac-address of this rogue device. After obtaining both of these, I went to my switch (Cisco 2950) and ran "show mac-address-table" to find where the mac-address was physically plugged into the switch. The results do not show it to be on any FastEthernet port but rather on my Gigabit port. Even more oddly is, unlike all the other listings which show the ports as either FA0/1 or Gi0/1, this particular one is showing only "Gi0/". How do I find this device when it shows on my fiber port? I've traced everywhere I can think of. Thanks, Lu

  • LAN Switching and Routing
5 REPLIES
Hall of Fame Super Blue

Re: Isolating a mac address

Hi

What is on the other end of the fibre link ?

Jon

New Member

Re: Isolating a mac address

an identical switch (2950). I forgot to mention that the ip address of this unknown device is a 192.168.168.x which is clearly not our internal addressing scheme either.

Hall of Fame Super Blue

Re: Isolating a mac address

Have you tried "sh mac-address-table" on this other switch then ?

Jon

New Member

Re: Isolating a mac address

yes, and it doesn't show this mac-address at all. Only the one switch does.

Silver

Re: Isolating a mac address

Grab another PC and have it request an IP address right before you do this. It could be that nobody has requested an IP address in 5 minutes, so the mac-address entries have aged out of your switches.

115
Views
0
Helpful
5
Replies