Today's networks are increasingly complex,
they have more network infrastructure to support the internet of everything.
Path redundancy makes the networks robust,
but also makes them more complex to support and troubleshoot.
As a network engineer,
I have often been required to find a particular computer in a complex
LAN of hundreds of wired and wireless computers,
virtual systems, and servers.
I am rarely presented with a network map, and if I am, it's never up-to-date.
Furthermore, it is generally a logical map and not a physical one,
which means that I cannot note anything about the
physical location of the systems.
If I'm very lucky that day,
there is a spreadsheet which tells me the closet identifier
where each piece of network equipment resides.
So the problem becomes how do I find a host in this complex LAN.
The method is actually quite simple as long as you have enough administrative
access to the LAN to query the network routers and switches.
If you have the target's IP address,
a couple simple network tools and commands will get
you to the correct switchboard.
The particular commands you're going to need are dependent upon the
vendor and operating system used in your network gear.
In the upcoming demonstration, I'll be using Cisco,
but the same concepts can be applied to any vendor and any equipment.
First,
start with the gateway router or Layer-3 switch for the
network or VLAN where the target resides.
In my current business which globally has hundreds of networks,
this first requires finding the gateway's management WAN IP address to log in.
I can do this by consulting documentation as I often either
do not have this or do not have time,
I simply used trace route to anything in the target network.
The next to last result in the trace route is usually the
gateway with which I need to start.
Once logged into that gateway, ping the end target computer,
this ensures that the gateway's ARP cache has an up-to-date
entry for the target's IP and MAC addresses.
Then you will need to inspect the ARP cache on the gateway
for that IP to obtain its MAC address.
The rest of the process requires that you interrogate each switch's MAC
address tables to find the port with the target MAC address.
Most of the switches in the path will show the target's MAC
address on a port with multiple other MAC addresses.
These are trunks to other switches.
This means you will need to log into each one through what I call
Telnet or SSH hopping until you get to a switch where the target
Mac address is only on one port, that port is where your target resides.
If you only need the final switchport, you're done.
If you need the physical location,
I hope you have a list of which switchport is connected to which room jack,
then you know where your target physically sits and you're done.
Otherwise, it's a matter of having feet on the street as they say.
Someone needs to be at the physical location and look at the punch panels in
the closet where that switch is for the room jack identifier which connects to
your final switchboard and then find that room.
If you don't have room jack identifiers on your punch panels and room jacks,
goodness help you because there will be some more fun
trying to trace the wire to its destination.
Let's go directly to the demonstration to see how this works.
Let's start by taking a look at my demonstration network.
I've got a pair of gateway routers connected to two
different ISPs for redundancy,
they're connected into CoreSwitch1 and CoreSwitch2,
then those two core switches are connected into two access layer
switches where we'll find our target host.
Our target is 20.
1.
5 somewhere in the inner network.
I'll start at my GtwyRouter01 and I'll ping 20.
1.
5.
At that point,
I'll look in the ARP cache and this is where ARP is
helping us in our troubleshooting.
I'll show the ARP cache on the router for 20.
1.
5 so that I can get its MAC address.
At that point,
I'll pick one of the two core switches to jump to and I'll look in
its MAC address tables for the MAC address of 20.
1.
5.
At that point,
it's a matter of looking at the trunks to see which one has that MAC
address and which access switch is down that trunk.
At that point,
I'll jump to one of the access switches and I'll look for the individual port
with our MAC address on it and that's where my host will me.
Let's go to the configuration prompt on my GtwyRouter01.
I've just started my remote session to my gateway router.
I'll log in.
Now again, the first thing I want to do is I want to ping my target at 20.
1.
5.
This puts its MAC address in my ARP cache so I'll show my ARP cache.
If your ARP cache is large and you're using Cisco equipment,
you can use show arp and then just give the IP address of the device.
This is a great way to just get the MAC address that you want.
Before I go any further, since I'm using PuTTY,
I'm going to copy that MAC address into the buffer.
Next, I'm going to use show cdp neighbors to find out who my neighbors are.
This is, of course,
a Cisco command that lets me know what other Cisco
devices are directly connected.
Here, it looks like I've got core switch 2 out of my FastEthernet 0/1,
I've got the ISP router out of my serial interface,
and I've got CoreSwitch1 out of my FastEthernet 0/0.
At this point,
I need to get to a switch MAC address table to
start looking for that MAC address.
I'm going to go to CoreSwitch1.
Now if I don't have an accurate map, I can just ask CDP for more detail,
show cdp neighbors f0/0 detail,
and I can see the IP address of my CoreSwitch1 right here.
I'm going to make sure I have connectivity to it by pinging it
and then I'm going to either SSH or Telnet hop.
If you're worried about security, use SSH.
In my lab here, I'm not, so I'm going to use Telnet to 20.
1.
50.
I'll log in.
What I'm looking for now is that MAC address.
I will show my MAC address table for the address that I
just copied for my router's ARP cache.
This shows me that it's on FastEthernet 1/0/23.
However, my guess is this is a trunk and it's not unique.
Show interfaces trunk shows me that FastEthernet 1/0/23 is indeed a trunk.
If this is indeed a trunk,
there is probably a lot of MAC addresses down that trunk and there is,
but of course, my target is also down there.
So what I need to know is what is my next switch down the line.
I'll use show cdp neighbors for fa1/0/23 and I'll look at the
detail to find its management IP address.
That's my access switch 200 and its IP address is right here.
Again, I'm going to Telnet hop or SSH hop to that management IP address, 20.
1.
200.
I'll log in, and once again,
I'll use show MAC address table for that MAC address.
Right here, it shows my target MAC address is on FastEthernet 0/15.
I don't know whether this is a trunk to another switch so I'll show
interfaces trunk and it looks like FastEthernet 15 is not a trunk,
but I'm going to verify it's an access port and what VLAN it's
on with show vlan brief and I can see that my target MAC
address is on an access port on VLAN 1.
At this point, if I need more information about its physical location,
I'm going to have to find out where FastEthernet
0/15 is connected into a room port.
It's that simple.
Start at your gateway router or Layer-3 switch,
ping your target IP to get its MAC address in the ARP cache,
and then jump to your switch infrastructure to start looking for
that MAC address in the switch MAC address tables.
Again,
the commands you will use will depend upon your
vendor and their operating system, but the concept is the same.
This is a great technique to have in your toolkit to find a host and a complex LAN.