From time to time, you want find out what port a specific computer, printer, server, or other network device is connected when you have the IP Address of the device. Possibly a device is sending broadcast storm or misbehaving on the network and you want disconnect it.
The first step is to find out the MAC Address of the device by pinging the device from your computer and issuing arp -a command.
Pinging 192.168.1.125 with 32 bytes of data:
Reply from 192.168.1.125: bytes=32 time<1ms TTL=255 Reply from 192.168.1.125: bytes=32 time<1ms TTL=255 Reply from 192.168.1.125: bytes=32 time<1ms TTL=255 Reply from 192.168.1.125: bytes=32 time<1ms TTL=255 Ping statistics for 192.168.1.125: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
We ping the device to get it in the local arp cache. Now issue arp -a command to display the IP addresses and associated MAC Address.
Interface: 192.168.1.138 — 0xb
Internet Address Physical Address Type
192.168.1.125 00-57-57-aa-33-44 dynamic
192.168.1.6 00-0c-29-cf-80-38 dynamic
192.168.1.10 00-12-80-0a-9f-ah dynamic
192.168.1.11 00-17-a4-c4-43-06 dynamic
192.168.1.15 00-1d-b3-89-46-c5 dynamic
192.168.1.19 00-18-fe-e6-1f-c4 dynamic
192.168.1.20 00-50-56-a9-22-d0 dynamic
192.168.1.22 6c-41-6a-fe-2a-c8 dynamic
192.168.1.23 00-50-56-aa-6b-24 dynamic
192.168.1.29 c8-1f-66-c3-57-a4 dynamic
192.168.1.36 00-c0-ee-1b-5c-c3 dynamic
192.168.1.40 00-50-56-b2-41-e6 dynamic
192.168.1.42 00-0e-b6-85-73-45 dynamic
Take note of the device’s MAC address (eg 00-57-57-aa-33-44 for this example).
Logging to your switch and issue the following command to located the source port.
CoreSwitch#show mac address-table | include 0057.57aa.3344
1 0057.57aa.3344 DYNAMIC Gi1/0/47
On the above example, we see that the the device with MAC Address 0057.57aa.3344 is connected on port 47 of CoreSwitch and it’s Dynamic which means it’s learned MAC Address, not manually entered.Publisher: abdirahman isse