Warning: session_start(): Cannot send session cookie - headers already sent by (output started at /home/circui15/public_html/packetpros.com/index.php:4) in /home/circui15/public_html/packetpros.com/wp-content/plugins/wp-file-upload/wordpress_file_upload.php on line 2

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/circui15/public_html/packetpros.com/index.php:4) in /home/circui15/public_html/packetpros.com/wp-content/plugins/wp-file-upload/wordpress_file_upload.php on line 2
Find a device in the network

Always start at the Layer 3 boundary of the subnet. Do a show arp to find the MAC address.

CORE1#sh arp | inc 10.142.3.2
Internet 10.142.3.207 11 0001.e67a.dc20 ARPA Vlan423
Internet 10.142.3.206 10 0001.e697.cbe6 ARPA Vlan423
Internet 10.142.3.254 - 0000.0c07.ac01 ARPA Vlan423
Internet 10.142.3.253 - 000d.662f.2980 ARPA Vlan43
Internet 10.142.3.252 0 000d.662f.2140 ARPA Vlan423
Internet 10.142.3.250 0 00c0.f044.5b72 ARPA Vlan423

If you do not see the device in the ARP Table (like above) you may need to ping it.

CORE1#ping 10.142.3.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.142.3.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

CORE1#sh arp | inc 10.142.3.2
Internet 10.142.3.207 11 0001.e67a.dc20 ARPA Vlan423
Internet 10.142.3.206 10 0001.e697.cbe6 ARPA Vlan423
Internet 10.142.3.254 - 0000.0c07.ac01 ARPA Vlan423
Internet 10.142.3.253 - 000d.662f.2980 ARPA Vlan423
Internet 10.142.3.252 0 000d.662f.2140 ARPA Vlan423
Internet 10.142.3.250 0 00c0.f044.5b72 ARPA Vlan423
Internet 10.142.3.2 0 000c.5502.1e62 ARPA Vlan423
CORE1#

Now we see the device and its MAC address. Now we need to find out where the core switch learned the address from.

CORE1#sh mac-address-table address 000c.5502.1e62
Legend: * - primary entry
age - seconds since last seen
n/a - not available

vlan mac address type learn age ports
------+----------------+--------+-----+----------+--------------------------
Supervisor:
* 423 000c.5502.1e62 dynamic Yes 80 Gi13/13

We can see that the switch learned it via VLAN 423 through interface Gi13/13. Next we need to see what Gi13/13 is connected to.

CORE1#sh cdp neighbors gi13/13
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID
DISTR-1 Gig 13/13 150 R S I WS-C4506 Gig 2/5
CORE1#

You can see from CDP that Gi13/13 is connected to switch DISTR-1. Next we telnet into that switch and look for the MAC address again.

DISTR-1#sh mac-address address 000c.5502.1e62
Unicast Entries
vlan mac address type protocols port
-------+---------------+--------+---------------------+--------------------
423 000c.5502.1e62 dynamic ip GigabitEthernet4/1

DISTR-1#

Again the switch learned the MAC on VLAN 423 via Gi4/1. We again look to see what is connected to interface Gi4/1.

DISTR-1#sh cdp neighbors gi4/1
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID
ACCESS-SW23.wpsic.com
Gig 4/1 136 S I Cisco WS-CGig 0/2
DISTR-1#

We see that the MAC address was learned from switch ACCESS-SW23. Telnet into that switch and look for the MAC again.

ACCESS-SW23#sh mac-address-table address 000c.5502.1e62

Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
423 000c.5502.1e62 DYNAMIC Fa0/27
Total Mac Addresses for this criterion: 1
ACCESS-SW23#

By looking under the Ports header we see that the access layer switch learned the MAC address from switch port Fa0/27. That’s the switch and switch port the device is connected too, ACCESS-SW23 on port fa0/27!