Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Tracking an ip or mac address to a switch.

From the nachi virus I still have stations that have the virus. Besides turning off the hub switch, I can't quickly find the device. Is there a procedure or command to pinpoint a port on a switch that is broadcasting?

4 REPLIES
New Member

Re: Tracking an ip or mac address to a switch.

I am sure it depends on the hardware but this works on 2900 and 3550 type switches.

- Ping the station doing the broadcast from the switch.

- Check the arp table to get the mac address corrsponding to the IP

- Check the mac table to find the interface.

Work your way up to the next switch if the interface you find is a trunk.

Hope it helps.

Re: Tracking an ip or mac address to a switch.

You can also use l2trace command on CatOS switches.

Regards,

Milan

Purple

Re: Tracking an ip or mac address to a switch.

Must have at least 6.X code to run l2trace though .

New Member

Re: Tracking an ip or mac address to a switch.

if these are cat switches, you can do "sho port mac" after you clear counters. identify which port is doing excessive broadcast.

Nachi will try to hit all of your networks. the other solution is have an acl on your router, and review the log. more solutions can be found on www.cert.org

350
Views
0
Helpful
4
Replies