Cisco: Trace MAC or IP addresses to switch ports

Sometimes, people ask me to locate switch ports where their machines/servers are connecting to, given that I have the MAC or IP addresses of their devices.
To accomplish this task, I used to use a set of commands show arp, show mac address and show cdp neighbors on different switches in the network.
However, I had found another way/command which helps me to quickly get the job done. It is traceroute mac command with two following options:
-
-
- traceroute mac source-MAC destination-MAC
- traceroute mac ip source-IP destination-IP
-
The command will run a L2 trace to identify a path from source address to destination address. The output of this command contains the information of the switch ports where the source and destination hosts are connecting to, and all switch-to-switch connections in between. Bear in mind that you need to run this command on L3 device.
Let me show you how it works with the network diagram above.
Note: all hosts in the network must be reachable from a L3/Core device. I have to make sure that their IP and MAC addresses shown up when issuing the show arp command
|
1
2
3
4
5
6
7
|
Core#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.100.1 – 0035.1aff.80c1 ARPA Vlan100
Internet 192.168.100.10 2 00a0.a423.90bc ARPA Vlan100
Internet 192.168.100.20 3 448a.5bbc.ff61 ARPA Vlan100
Internet 192.168.200.1 – 0035.1aff.80f6 ARPA Vlan200
Internet 192.168.200.10 3 40f2.e985.5308 ARPA Vlan200
|
Case 1
If I want to trace the switch ports for devices with IP addresses of 192.168.100.20 (448a.5bbc.ff61) and 192.168.100.10 (00a0.a423.90bc). I use the following commands and place the IP or MAC addresses in either source or destination addresses:
|
1
2
3
4
5
6
7
8
9
10
11
|
Core#traceroute mac ip 192.168.100.20 192.168.100.10
Translating IP to mac .....
192.168.100.20 => 448a.5bbc.ff61
192.168.100.10 => 00a0.a423.90bc
Source 448a.5bbc.ff61 found on Access2
1 Access2 : Gi0/2 => Gi0/24
2 Core : Gi0/2 => Gi0/1
3 Access1 : Gi0/24 => Gi0/6
Destination 00a0.a423.90bc found on Access1
Layer 2 trace completed
|
|
1
2
3
4
5
6
7
|
Core#traceroute mac 448a.5bbc.ff61 00a0.a423.90bc
Source 448a.5bbc.ff61 found on Access2
1 Access2 : Gi0/2 => Gi0/24
2 Core : Gi0/2 => Gi0/1
3 Access1 : Gi0/24 => Gi0/6
Destination 00a0.a423.90bc found on Access1
Layer 2 trace completed
|
The outputs tell me that source device (IP: 192.168.100.20 and MAC: 448a.5bbc.ff61) is on port G0/2 of Access2 switch and the destination device (IP: 192.168.100.10 and MAC: 00a0.a423.90bc) is on port G0/6 of Access1 switch.
Case 2
I want to trace the switch ports for devices with IP addresses of 192.168.200.10 (40f2.e985.5308) and 192.168.100.20 (448a.5bbc.ff61). I notice that they are NOT in the same subnet/vlan (192.168.200.0/24 vs 192.168.100.0/24, and Vlan 200 vs Vlan 100):
|
1
2
|
Core#traceroute mac ip 192.168.200.10 192.168.100.20
Source and Destination are not on same subnet
|
|
1
2
3
|
Core#traceroute mac 40f2.e985.5308 448a.5bbc.ff61
Error: Source and destination macs are on different vlans.
Layer2 trace aborted.
|
I get nothing but error messages.
As mentioned earlier, this is a L2 trace, if I use the source and destination IPs in different subnets, it will not work at all. Instead, I will get the message “Source and Destination are not on same subnet”, with MAC addresses, it is “Error: Source and destination macs are on different vlans.”
To overcome this issue, I would like to pick two additional IP or MAC addresses, one in 192.168.200.0/24 (Vlan 200) and the other in 192.168.100.0/24 (Vlan 100), which are in the same subnets/vlans with IP or MAC addresses above.
I can easily find them in ARP table, but it would be more convenient when I take the IP addresses of Interface Vlan 100 and 200 because they are already in my memory.
|
1
2
3
4
5
6
7
8
9
10
|
Core#traceroute mac ip 192.168.200.1 192.168.200.10
Translating IP to mac .....
192.168.200.1 => 0035.1aff.80f6
192.168.200.10 => 40f2.e985.5308
Source 0035.1aff.80f6 found on Core
1 Core : Vl200 => Gi0/2
2 Access2 : Gi0/24 => Gi0/3
Destination 40f2.e985.5308 found on Access2
Layer 2 trace completed
|
It works perfectly! The source device is Core switch (Interface Vlan 200, IP: 192.168.200.1 and MAC: 0035.1aff.80f6) and the destination device (IP: 192.168.200.10, MAC: 40f2.e985.5308) is on port G0/3 of Access2 switch.
If you run the command and face the error massage “Mac found on multiple vlans”, it is because the source or destination MAC address belongs to multiple VLANs, you need to indicate the VLAN where they belong to:
-
-
- traceroute mac source-MAC destination-MAC vlan VLAN_ID
-
Nguồn: http://netlabbuilder.net/cisco-trace-mac-or-ip-addresses-to-switch-ports/