There are many times that a network administrator needs to locate a switch and port that a device is physically plugged into. This can be done manually by using the following example.

If the mac-address of a the device is known, then skip this first step of determining the mac-address from the IP address.

From the layer 3 device directly connected to the subnet containing the device to be found, ping the IP address of the host. From a cisco device the process will look like the following:

bna-lan-01#ping 10.120.2.100

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.120.2.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

It’s always a good idea to ping the device first. Otherwise, if there has been no recent communication to/from the device trying to be located, it will not appear in the arp table. Therefore, ping the device to ensure the mac address will be in the arp table. To locate the device, issue a show arp command with a pipe that includes the IP address of the host.

bna-lan-01#sh arp | inc 10.120.2.100
Internet  10.120.2.100            0   000d.23e4.1f20  ARPA   Vlan2
bna-lan-01#

The output of the show arp command will include the mac address along with what vlan the device resides in.. Now that the mac address of the host has been obtained, next issue the show mac-address command on the switch at the core of your network: In this example, the layer 3 device and the core switch is the same Cisco 6500 switch, with the name bna-lan-01.

bna-lan-01#sh mac-address-table address 000d.23e4.1f20
Legend: * - primary entry
        age - seconds since last seen
        n/a - not available

  vlan   mac address     type    learn     age              ports
------+----------------+--------+-----+----------+--------------------------
Supervisor:
*  2     000d.23e4.1f20  dynamic  Yes      80               Gi1/8

After issuing the show mac-address command, we see that the mac address was learned via Gigabit 1/8. From here, let’s assume the network is an all Cisco network and CDP is still running on the uplink ports. The next bit of information needed is what is connected on the other end of Gig1/8. Let’s do a show cdp nei to obtain that information:

bna-lan-01#sh cdp nei detail Gi1/8
-------------------------
Device ID: bna-asw-01
Entry address(es):
  IP address: 10.1.0.21
Platform: cisco WS-C3750-48TS,  Capabilities: Router Switch IGMP
Interface: GigabitEthernet1/8,  Port ID (outgoing port): GigabitEthernet1/0/49
Holdtime : 124 sec

Version :
Cisco Internetwork Operating System Software
IOS (tm) C3750 Software (C3750-I9-M), Version 12.1(19)EA1d, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 05-Apr-04 22:40 by antonino

advertisement version: 2
Protocol Hello:  OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=0FF0000
VTP Management Domain: 'BNA-NET'
Native VLAN: 257
Duplex: full

The downstream access switch is a 3750 with a management IP address of 10.1.0.21. The next step is to access this switch and issue the show mac address command on it.

bna-asw-01#sh mac-address-table address 000d.23e4.1f20
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 2      000d.23e4.1f20    DYNAMIC     Gi1/0/4

The output shows the host connected to the port Gigabit 1/0/4. If there had been another switch in between bna-asw-01 and the host, we would just do the same thing as previously – which is issue the show cdp neighbor command and find the management IP of the next access switch.