On the hunt for a MAC-adress

[niklasw]

Hi there.

I manage a MAN, and one of our users is distributing IP-adresses, and we dont want that. I have his MAC-adress, but I cannot seem to find it in the bridge in any of the passports. Does anyone know the time NortelPassports stores the MAC-adresses? And when they are discarded, can they be found somewhere else? Anyother place to find the MAC that I havent thought of??

-Cheers, Niklas

 

[Jynxx]

Do you have routed links that this MAC address is behind? If so, you can look at the ARP table of the router for that segment/network range and that will give you the IP.

What type of passports are you talking about when you mention the bridging tables?

If it is Passport 8000's, then it SHOULD be showing up. I think the bridging tables will age out after about 3-5 minutes if the user unplugs the PC or it stops communicating for any reason...regardless, if they are on long enough to get the MAC address, you should be able to find it on the Passports.

Gotta love rogue DHCP servers...

 

[ecuamer]

I have run through a simlar problem where i was trying to find a IP address on the arp table of my 8600 but there was no entry , but i was able to find the mac entry on the router ( ASN ROUTER ) since the age out time is much longer. Not sure how long the ARN router holds the entry but you can try looking on the router if you don't see it on the switch .

 

[riot6]

I'm guessing you are using the sho ip arp info CLI command to locate this MAC? If that isn't working, is the user directly connected to the Passport in quesiton? You could try sho vlan info all, then look for the MAC towards the bottom of the output. It's layer 2 so you won't see the IP but you could locate it, kill the port and wait for the user to scream.... Good luck.