Find a device in the network

Always start at the Layer 3 boundary of the subnet. Do a show arp to find the MAC address.

If you do not see the device in the ARP Table (like above) you may need to ping it.

Now we see the device and its MAC address. Now we need to find out where the core switch learned the address from.

We can see that the switch learned it via VLAN 423 through interface Gi13/13. Next we need to see what Gi13/13 is connected to.

You can see from CDP that Gi13/13 is connected to switch DISTR-1. Next we telnet into that switch and look for the MAC address again.

Again the switch learned the MAC on VLAN 423 via Gi4/1. We again look to see what is connected to interface Gi4/1.

We see that the MAC address was learned from switch ACCESS-SW23. Telnet into that switch and look for the MAC again.

By looking under the Ports header we see that the access layer switch learned the MAC address from switch port Fa0/27. That’s the switch and switch port the device is connected too, ACCESS-SW23 on port fa0/27!

Leave a Reply