Thursday, April 11, 2013

Cisco - Never trace a cable

By using the show mac-address, sh arp, and sh cdp neighbor commands, you can avoid almost all cable tracing.

(Please note that the show mac command can either be show mac-address-table or mac address-table (no dash after mac) depending on the switch)

First if you have a mac address of a client that you want to find the port of do this:
  1. Start by connecting to a switch and type 'show mac address-table address ###.####.####   (ie. sh mac address-table address 0017.a4d7.fadf)
  2. This will return the port that the mac address is reported to be on.
  3. Check that another switch is not connected to that port by using 'sh mac address-table port#'  (ie. Sh mac address-table address gig1/1/1)
  1. If you have just one mac address then you know the client is connected to that port.  If you have a large list then another switch is most likely connected to that port.  To look up the next switch, type the following command (only works with switches that support cdp, Cisco Switches)  'show cdp nei (port#) detail  use the port number from before.  (ie. Show cdp neighbor gig1/1/1)
  1. This will give you a description and IP address of the next switch in the chain.  Use the same mac address command there to narrrow down the location of the port.  Always check the mac addresses on the port (sh mac address-table port#) to make sure you are not changing something that a switch is connected to.

If you know the IP address of the client you want to find the port of, you can ping the address from the switch (if it is on a vlan that has an IP in the clinet's subnet).  This will refresh the arp table for that address, then you can type 'sh arp' to list the Ips, mac addresses.  Remember to always check the mac addresses on the port to make sure there is only 1 (maybe 2) mac addresses on the port to verify that another switch is not connected to that port.

Good Luck!

NetFlow on IOS

Some quick articles are here for me to remember more than they are anything else...

Configuring NetFlow on switches and routers is pretty straight forward.  There are a couple of things to keep in mind:

  • Support or features per device vary
  • Are you looking for layer 2 or 3 traffic?

Netflow was designed to report on traffic being routed.  Therefore you may not see traffic that stays on the same VLan without extra configuration.

To turn on NetFlow:
R1(config)#interface fa0/1
R1(config-if)#ip route-cache flow

Next export the info to a network management station of some sort:
R1(config)#ip flow-export 2055 version 5   (2055 is the UDP port (optional) and version can be 5 or 9, depending on what you NMS supports)

Enabling layer 2 for NetFlow on a Vlan:
R1(config)#ip flow export layer 2-switched vlan 10,20-25     (for VLan 10,20-25)

There are many more options available here:

Hopefully this helps you out.