Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Need IP address from MAC address

I have a problem with some NIC teaming configurations. I used ethereal to gather packets. Many broadcasts are being made by NIC teams but only the MAC address shows up in the sniffed packets. What is the best way to determine the IP address from the MAC addresses. I tried a sho arp on the routers and switches with limited success. Please advise....

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Re: Need IP address from MAC address

Christopher

show arp will work only when you are on a router in the same subnet as the device. Otherwise the MAC in the ARP table for a device in a different subnet will be the address of the next hop router.

My suggestion would be to look in the mac-address-table (or CAM depending on the model of switch) for the MAC address. find what port it is associated with. if the port is a trunk port, then you need to go to the switch connected on that port and look in its table. eventually you will get to the switch where the MAC is on an access port. At that point you know the VLAN that it is in. Go to the router that is the gateway for that VLAN and check its ARP table. If you are lucky the MAC will be in the ARP table with the IP address. If it is not in the table then you may need to issue ping for the addresses in the subnet till you hit the right station.

this is pretty labor intensive. But I do not know of a better way that is reliable. Of course you might get lucky and look in the sniffed capture file for all occurances of that MAC and find some unicast packet where it shows up with its IP address.

HTH

Rick

1 REPLY
Hall of Fame Super Silver

Re: Need IP address from MAC address

Christopher

show arp will work only when you are on a router in the same subnet as the device. Otherwise the MAC in the ARP table for a device in a different subnet will be the address of the next hop router.

My suggestion would be to look in the mac-address-table (or CAM depending on the model of switch) for the MAC address. find what port it is associated with. if the port is a trunk port, then you need to go to the switch connected on that port and look in its table. eventually you will get to the switch where the MAC is on an access port. At that point you know the VLAN that it is in. Go to the router that is the gateway for that VLAN and check its ARP table. If you are lucky the MAC will be in the ARP table with the IP address. If it is not in the table then you may need to issue ping for the addresses in the subnet till you hit the right station.

this is pretty labor intensive. But I do not know of a better way that is reliable. Of course you might get lucky and look in the sniffed capture file for all occurances of that MAC and find some unicast packet where it shows up with its IP address.

HTH

Rick

110
Views
0
Helpful
1
Replies
CreatePlease login to create content