I'm trying to find an app that will trace a mac address back to where it came from. We have Cisco 3500 switches in the closets & a 6509 in the main computer room. Two users on our network (1200+) are getting strange mac addresses showing up on their ports. We have port security enabled on all switches & they are all locked down to 1 mac address each. Every so often, I get a pop-up message saying one of the 2 ports "has been locked by mac address 0800.45**.****". The first 6 digits are always the same. It seems to bouce between the 2 ports, one will get locked one day, then a few days later the other will get locked. We use CiscoWorks 2000, but these mac addresses do not show up in any of the address lists. Both users are managers & do not have any other equipment to plug into their ports, nor does anyone else have access to their ports. Anyone who can lend some info on how to track down where these 'rogue' mac addresses are coming from, it would be greatly appreciated.