How to find port number of PC based on IP Address?

[KThug]

I have a machine on my network sending out wierd packets, ip spoofing almost. Anyway, how could I find out which port of the switch this machine is on? There is evidently some sort of a program running that changes its IP everyso often. We are using the 172.16.1.0/24 network and the machine in question sends packets like its a class A, changing the 2nd octet randomly. Obviously, if i could find out which port on the switch this machine is broadcasting from, i could trace to a location and figure out what is going on.

Any help is greatly appreciated.

Steve Kennemer

 

[BuckWeet]

Need to find the source mac address, then follow that back to its port. It'll take some time though..


BuckWeet

 

[vasquezj]

Steve:

I would put a sniffer on the switch to determine where the packets our going. That would be a start.

good luck.

 

[KThug]

ok...if i am able to find the mac address, which IOS command would list the port on the switch with givin mac address? Is that even possible?

 

[Dimonet]

Try this....

The command is - >show cam <mac address>

you will notice it shows you what port it is on.

switch> (enable) show cam 00-00-00-00-00-00
* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.
X = Port Security Entry $ = Dot1x Security Entry

VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]
---- ------------------ ----- -------------------------------------------
1 00-00-00-00-00-00 6/30 [ALL]
Total Matching CAM Entries Displayed =1

 

[netbum]

If it is for OS try this.

Show ip arp x.x.x.x ---to get mac address
show mac-address table --- to get port number