Cisco – Finding Non-Cisco End Device IP Addresses Connected to Cisco Switch

The answer depends on whether the switch is a Layer 2 or a Layer 3 switch. That is to say, is the switch only switching and relaying traffic on to a different device for routing, or, is it doing the routing decisions itself via SVIs (switched virtual interfaces).

On a layer 3 switch, the port can be found by using a few simple commands on the device. However on a layer 2 switch, you have to log into both the switch and whatever device is doing the routing to locate the port.

In either case, the commands are the same, just run on two different boxes for the layer 2 switch.

On a Layer 3 switch:

• Log into the switch and issue the following command (where ipaddress is the ip address of the host you are trying to locate:

  show ip arp *ipaddress*
  

• The output should look similar to below, and give you the mac-address of the device (I've highlighted the mac-address below in bold).

  LYKINS-1861#show ip arp 172.20.1.100
  Protocol  Address          Age (min)  Hardware Addr   Type   Interface
  Internet  172.20.1.100            0   **28cf.da1d.1b05**  ARPA   Vlan10
  

• Now issue one of the following commands (where mac-address is the hardware address from previous step). Depending on the Cisco platform, sometimes the command is listed in either form.

  show mac address-table address *mac-address*
  show mac-address-table address *mac-address*
  

• The output should look similar to below, the port you are looking for should be listed as the Destination Port:

  LYKINS-1861#show mac-address-table address 28cf.da1d.1b05
  Destination Address  Address Type  VLAN  Destination Port
  -------------------  ------------  ----  --------------------
  28cf.da1d.1b05          Dynamic      10     **FastEthernet0/1/1**
  

On a Layer 2 switch:

• Find out what device is doing the routing for this switch (you may have to look at the network documentation). Sometimes it is a "Router on a Stick", where the Layer 2 VLANs are being trunked up to the router for the Layer 3 decisions.

• Log into the routing device, and issue the following command (where ipaddress is the ip address of the host you are trying to locate:

  show ip arp *ipaddress*
  

• The output should look similar to below, and give you the mac-address of the device (listed below in bold).

  LYKINS-1861#show ip arp 172.20.1.100
  Protocol  Address          Age (min)  Hardware Addr   Type   Interface
  Internet  172.20.1.100            0   **28cf.da1d.1b05**  ARPA   Vlan10
  

• Now log into the Layer 2 switch

• On that device issue one of the following commands (where mac-address is the hardware address from previous step). Depending on the Cisco platform, sometimes the command is listed in either form.

  show mac address-table address *mac-address*
  show mac-address-table address *mac-address*
  

• The output should look similar to below, the port you are looking for should be listed as the Destination Port:

  LYKINS-1861#show mac-address-table address 28cf.da1d.1b05
  Destination Address  Address Type  VLAN  Destination Port
  -------------------  ------------  ----  --------------------
  28cf.da1d.1b05          Dynamic      10     **FastEthernet0/1/1**
  

There is no way for a switch to determine whether the device plugged in to a particular port is an 'end host' or a second switch with many end hosts. You could, guesstimate, that if multiple MAC addresses are learned on a single port, then that port is connected to another switch. But that leaves you open to misidentifying a connection to another switch with only one other host behind it as a host (and not an actual switch).

You would have to depend on some extra configuration on the switch, to identify whether the port is connected to an end-host, and if so, pull the MAC address table for that interface.

For example, if you pull a list of all the interfaces, and determine which of them are marked as "Portfast" (or "Edge" ports, for non Cisco gear). That is almost a guarantee of that particular interface being connected to an end host (just almost, see below comments by MikePennington and others), and then when you pull the full MAC address table, filter it to just 'store' the data on the portfast/edge ports.