Problem
Tracking down a specific host on your network through its IP address.
tl;dr
Run this command on a switch on the same VLAN or the central router:
Router1> show arp | include x.x.x.x
Where x.x.x.x is the IP in question. This will give you a MAC address which can be used to track down the host via the MAC address table:
Router1> show mac address-table | include aa11.bb22.cc33
Where aa11.bb22.cc33 is the MAC address.
Solution
If you need to track down an IP address on your network, you need to use your network devices' ARP table. If you have a switched network and your switches are on the same VLAN as the host, you can use the switches' ARP table. However, in most setups, the full ARP table will only be kept on the router, so it's best to start from that.
To find IP address 1.2.3.4, run this command on your router:
Router1> show arp | include 1.2.3.4
You will see an output such as this:
Internet 1.2.3.4 0 aa11.bb22.cc33 ARPA Vlan885
This will tell you the MAC address of the host is aa11.bb22.cc33.
You can then use the MAC address to narrow down the host by running it on the router itself and any subsequent switches in the routing table. To do that, run:
Router1> show mac address-table | include aa11.bb22.cc33
Right-most entry in the table is the port in the direction of the MAC address:
Router1>show mac address-table | include aa11.bb22.cc33
885 aa11.bb22.cc33 DYNAMIC Po5
Sample output
Router1> show arp | include 1.2.3.4
Internet 1.2.3.4 0 001e.6764.7e21 ARPA Vlan885
Router1> show mac address-table | include 001e.6764.7e21
Router1>show mac address-table | include 001e.6764.7e21
885 001e.6764.7e21 DYNAMIC Po5
Switch5> show mac address-table | include 001e.6764.7e21
Switch5>show mac address-table | include 001e.6764.7e21
885 001e.6764.7e21 DYNAMIC Fa0/40
This shows the IP address 1.2.3.4 is bound to MAC address 001e.6764.7e21. In turn, the MAC is connected to FastEthernet port #40 on Switch5.
- Updated