|
-
June 12th, 2002, 05:14 PM
#1
 Tracing MAC addresses
I'm trying to find an app that will trace a mac address back to where it came from. We have Cisco 3500 switches in the closets & a 6509 in the main computer room. Two users on our network (1200+) are getting strange mac addresses showing up on their ports. We have port security enabled on all switches & they are all locked down to 1 mac address each. Every so often, I get a pop-up message saying one of the 2 ports "has been locked by mac address 0800.45**.****". The first 6 digits are always the same. It seems to bouce between the 2 ports, one will get locked one day, then a few days later the other will get locked. We use CiscoWorks 2000, but these mac addresses do not show up in any of the address lists. Both users are managers & do not have any other equipment to plug into their ports, nor does anyone else have access to their ports. Anyone who can lend some info on how to track down where these 'rogue' mac addresses are coming from, it would be greatly appreciated. 
-
June 12th, 2002, 06:42 PM
#2
Registered User
Just a shot in the dark but have you considered trying fluke?
I seem to recall its monitoring software displaying where the MAC address was coming from though I could be wrong.
The strength of the turbulence is directly proportional to the temperature of you coffee.
(Gunter's Second Law of Air Travel)
If a program is useful, it will have to be changed.
(Laws of Computer Programming, III)
Thanx to Adept for the Avatar
-
June 13th, 2002, 06:00 PM
#3
Registered User
I could be wrong, but won't arp do this with the proper extention?
Never underestimate the power, or aggrevation, of stupid users in mass numbers..
-
June 13th, 2002, 06:15 PM
#4
</font><blockquote><font size="1" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">quote:</font><hr /><font size="2" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">Originally posted by jeffbrown:
<strong>I could be wrong, but won't arp do this with the proper extention?</strong></font><hr /></blockquote><font size="2" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">I thought so ... been a while since Ive used arp also, and the brain is somewhat rusty..
-
June 14th, 2002, 08:10 AM
#5
Registered User
Use arp -a or arp -g from the command line. The second column indicates the MAC.
If you need more switches, try <a href="http://www.computerhope.com/arphlp.htm" target="_blank">here</a>.
Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so. -Douglas Adams
-
June 14th, 2002, 10:38 AM
#6
This is on a Cisco 3500 switch. These mac addresses do not show up in the arp tables anywhere.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|
Reply With Quote
Bookmarks