Cisco: Trace MAC or IP addresses to switch ports

Cisco: Trace MAC or IP addresses to switch ports

Sometimes, people ask me to locate switch ports where their machines/servers are connecting to, given that I have the MAC or IP addresses of their devices.
To accomplish this task, I used to use a set of commands show arpshow mac address  and show cdp neighbors  on different switches in the network.

However, I had found another way/command which helps me to quickly get the job done. It is traceroute mac command with two following options:

      • traceroute mac source-MAC destination-MAC
      • traceroute mac ip source-IP destination-IP

The command will run a L2 trace to identify a path from source address to destination address. The output of this command contains the information of the switch ports where the source and destination hosts are connecting to, and all switch-to-switch connections in between. Bear in mind that you need to run this command on L3 device.

Let me show you how it works with the network diagram above.

Note: all hosts in the network must be reachable from a L3/Core device. I have to make sure that their IP and MAC addresses shown up when issuing the show arp command

Case 1

If I want to trace the switch ports for devices with IP addresses of 192.168.100.20 (448a.5bbc.ff61) and 192.168.100.10 (00a0.a423.90bc). I use the following commands and place the IP or MAC addresses in either source or destination addresses:

The outputs tell me that source device (IP: 192.168.100.20 and MAC: 448a.5bbc.ff61) is on port G0/2 of Access2 switch and the destination device (IP: 192.168.100.10 and MAC: 00a0.a423.90bc) is on port G0/6 of Access1 switch.

Case 2

I want to trace the switch ports for devices with IP addresses of 192.168.200.10 (40f2.e985.5308) and 192.168.100.20 (448a.5bbc.ff61). I notice that they are NOT in the same subnet/vlan (192.168.200.0/24 vs 192.168.100.0/24, and Vlan 200 vs Vlan 100):

I get nothing but error messages.
As mentioned earlier, this is a L2 trace, if I use the source and destination IPs in different subnets, it will not work at all. Instead, I will get the message “Source and Destination are not on same subnet”, with MAC addresses, it is “Error: Source and destination macs are on different vlans.”

To overcome this issue, I would like to pick two additional IP or MAC addresses, one in 192.168.200.0/24 (Vlan 200) and the other in 192.168.100.0/24 (Vlan 100), which are in the same subnets/vlans with IP or MAC addresses above.

I can easily find them in ARP table, but it would be more convenient when I take the IP addresses of Interface Vlan 100 and 200 because they are already in my memory.

It works perfectly! The source device is Core switch (Interface Vlan 200, IP: 192.168.200.1 and MAC: 0035.1aff.80f6) and the destination device (IP: 192.168.200.10, MAC: 40f2.e985.5308) is on port G0/3 of Access2 switch.

If you run the command and face the error massage “Mac found on multiple vlans”, it is because the source or destination MAC address belongs to multiple VLANs, you need to indicate the VLAN where they belong to:

      •  traceroute mac source-MAC destination-MAC vlan VLAN_ID

Nguồn: http://netlabbuilder.net/cisco-trace-mac-or-ip-addresses-to-switch-ports/

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top