How-To: Find the IP address of a device behind a Cisco switch
Posted by rbTech Staff on 13 February 2012 05:40 PM

Once in a while you need to find that device that's on your network that you don't have a record of.  I know, never happens, right?  Because you have DDNS and DHCP completely and properly configured on your entire network, and you never forget to add a manual PTR record when you do decide to statically address something like a printer, right?  Right.

So, in that entirely theoretical instance where you've got a device hidden on your network, there's a *super* easy way to find the IP address of the sneaky devil:

#sh mac address-table

The switch will return a nice list of each connected device, it's MAC address, and the IP address it's using (presuming it's got one that the switch is aware of - things like fiber-to-Ethernet transceivers will show either DYNAMIC or no IP info because they're logical bridges and don't actually have an IP unless they're the fancy (expensive), addressable type.

If you're on a network without a nicer switch, you may be able to sleuth it out by doing a broadcast ping, and/ or an 'arp -a' on a system with an OS with a functional network stack (e.g. not Windows).

And if you're really up against it, you can slam a hub (yes, I said hub) on the suspect switch port, and run wireshark on another device connected to that device.  Hubs are stupid, so they broadcast every packet to every port.  Bad for efficiency, but really, really useful for finding rogue devices by MAC address.

(0 vote(s))
Not helpful

Comments (0)
Post a new comment
Full Name:
CAPTCHA Verification 
Please enter the text you see in the image into the textbox below (we use this to prevent automated submissions).