Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Anyone know of fast method for tracking an IP to the end switch/mod/port?

I was wondering if anyone knows of any shell scripts or other tools designed to quickly trace an IP address to a particular switch, module/port. I've had cause to track down a large number of systems in the past (as a result of worm/virus activity)... where it is essential to quickly determine which switch, mod/port the host is on -- then disable the port.

Cisco Works user tracking isn't up to the task; the data must be essentially up-to-the-minute, and doing an IP lookup through the GUI, while fine for the occasional query, would be impossible for dozens (or hundreds) of addresses.

Right now, the process looks something like this:

- Get alert from IDS or firewall indicating suspicious activity

- Arp in proper subnet for offending IP's MAC address

- Telnet to root bridge switch

- Issue "show cam XX-XX-XX-XX-XX-XX" to see if MAC is local

- If MAC is local (shows up on non-trunked port), "set port dis X/Y"

- If MAC is on trunked port, "show cdp neighbor" to see where trunk goes

- Telnet to switch on other side of trunk

- Repeat MAC locating steps until we finally get to the right switch that the host is physically connected to

- Disable the host's port

In short, the process is a real pain :)

It looks like this would be reasonably easy to do with shell / Perl scripts... but scripting isn't my forte. I could probably do it after bumbling around for a month; but my guess is that someone out there has already managed to do this for 6000 series switches.

Any help / suggestions would be -very- much appreciated.

Cheers,

Mark Brown

3 REPLIES
Bronze

Re: Anyone know of fast method for tracking an IP to the end swi

The perl solution is really the only way outside of purchasing something custom made. Bite the bullet and do the perl work, you will be glad you did as it will give you the freedom to make changes and whatnot based upon your own particular enterprise.

New Member

Re: Anyone know of fast method for tracking an IP to the end swi

The L2TRACE command, available in some Cisco switch operating systems, is supposed to do exactly what you want. It requires that all the switches in the path have CDP enabled. See the link below.

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/sft_6_1/cmd_ref/ghi_cmd.htm#96626

New Member

Re: Anyone know of fast method for tracking an IP to the end swi

Try the Switch Port Mapper from http://solarwinds.net, this is one of the tools included in the Network Management Tools, they are not free but you can try it for 30 days.

This utility will give you list of ports/mac address/ip address on your switch or managed hub

95
Views
0
Helpful
3
Replies
CreatePlease to create content