Cisco – How to find the End device connected to a particular interface

The answer depends on whether the switch is a Layer 2 or a Layer 3 switch. That is to say, is the switch only switching and relaying traffic on to a different device for routing, or, is it doing the routing decisions itself via SVIs (switched virtual interfaces).

On a layer 3 switch, the port can be found by using a few simple commands on the device. However on a layer 2 switch, you have to log into both the switch and whatever device is doing the routing to locate the port.

In either case, the commands are the same, just run on two different boxes for the layer 2 switch.

On a Layer 3 switch:

• Log into the switch and issue the following command (where ipaddress is the ip address of the host you are trying to locate:

  show ip arp *ipaddress*
  

• The output should look similar to below, and give you the mac-address of the device (I've highlighted the mac-address below in bold).

  LYKINS-1861#show ip arp 172.20.1.100
  Protocol  Address          Age (min)  Hardware Addr   Type   Interface
  Internet  172.20.1.100            0   **28cf.da1d.1b05**  ARPA   Vlan10
  

• Now issue one of the following commands (where mac-address is the hardware address from previous step). Depending on the Cisco platform, sometimes the command is listed in either form.

  show mac address-table address *mac-address*
  show mac-address-table address *mac-address*
  

• The output should look similar to below, the port you are looking for should be listed as the Destination Port:

  LYKINS-1861#show mac-address-table address 28cf.da1d.1b05
  Destination Address  Address Type  VLAN  Destination Port
  -------------------  ------------  ----  --------------------
  28cf.da1d.1b05          Dynamic      10     **FastEthernet0/1/1**
  

On a Layer 2 switch:

• Find out what device is doing the routing for this switch (you may have to look at the network documentation). Sometimes it is a "Router on a Stick", where the Layer 2 VLANs are being trunked up to the router for the Layer 3 decisions.

• Log into the routing device, and issue the following command (where ipaddress is the ip address of the host you are trying to locate:

  show ip arp *ipaddress*
  

• The output should look similar to below, and give you the mac-address of the device (listed below in bold).

  LYKINS-1861#show ip arp 172.20.1.100
  Protocol  Address          Age (min)  Hardware Addr   Type   Interface
  Internet  172.20.1.100            0   **28cf.da1d.1b05**  ARPA   Vlan10
  

• Now log into the Layer 2 switch

• On that device issue one of the following commands (where mac-address is the hardware address from previous step). Depending on the Cisco platform, sometimes the command is listed in either form.

  show mac address-table address *mac-address*
  show mac-address-table address *mac-address*
  

• The output should look similar to below, the port you are looking for should be listed as the Destination Port:

  LYKINS-1861#show mac-address-table address 28cf.da1d.1b05
  Destination Address  Address Type  VLAN  Destination Port
  -------------------  ------------  ----  --------------------
  28cf.da1d.1b05          Dynamic      10     **FastEthernet0/1/1**
  

I frequently use

sh int | i (FastEthernet|0 packets input)

or the same with GigabitEthernet, whatever kind of interfaces I want to check.

• sh int (which is show interfaces) gives a huge list of ste status of all interfaces
• The pipe symbol | can be used for filtering, but also in search expressions
• | i (for include) filters the output which matches the following search expressions
• I use (...|...) to match two conditions: the interface name and a status I like to see, we can use regular expressions here, like this "or" expression

The output can look like:

...
FastEthernet1/0/31 is up, line protocol is up (connected)
     95445640 packets input, 18990165053 bytes, 0 no buffer
FastEthernet1/0/32 is up, line protocol is up (connected)
FastEthernet1/0/33 is up, line protocol is up (connected)
FastEthernet1/0/34 is down, line protocol is down (notconnect)
     0 packets input, 0 bytes, 0 no buffer
FastEthernet1/0/35 is down, line protocol is down (notconnect)
FastEthernet1/0/36 is up, line protocol is up (connected)
FastEthernet1/0/37 is down, line protocol is down (notconnect)
     0 packets input, 0 bytes, 0 no buffer
...

Now I can see my candidates, with actually 0 packets input over time, even if my expression matches numbers just ending with 0. I could make it more perfect, but being easy to remember is also a benefit. The interface names right before each 0 packets input lines are my candidates.

• Check each chosen interface if it's really unused by sh int <name>
• From time to time, it's good to clear the counters: clear counters [type number]

It can be good practice, to leave unused switchports shutdown. So it's easy to identify them using sh ip int bri or the like. And you don't run into problems if you use a switchport which was definitly shut off before.