Cisco Switch Commands
Step 4 of 850%

Finding Devices

Real troubleshooting often starts with partial information. You might know an IP address but not the port, or a MAC address but not the wall jack. The switch can help you follow the clues.

After this page, you should be able to:

  • Use ARP to map an IP address to a MAC address
  • Use the MAC address table to locate the switchport that learned a device
  • Understand why Layer 2 and Layer 3 clues both matter
  • Build a repeatable IP-to-MAC-to-port workflow

show arp: IP to MAC

Switch devices now: open R1, go to the CLI tab, and get to R1#. Use the router because R1 is the gateway for the printer VLAN in this Packet Tracer lab.

ping 192.168.20.50
show arp

maps IP addresses to MAC addresses. Depending on the design, you may run this on the switch, router, firewall, or Layer 3 gateway for the .

In this lab, R1 is the Layer 3 gateway for VLAN 20, so it is the best place to ask, “Which MAC address belongs to 192.168.20.50?” Ping PRINTER1 from R1first so the router has a reason to learn the printer's MAC address. Then run show arp and look for the line that contains 192.168.20.50. If the line is there, copy the MAC address from that ARP line now. In the known-good lab, that ARP entry should appear after a successful ping. If the line is missing, verify PRINTER1's IP settings, default gateway, and cabling before trusting the MAC-table step.

show mac address-table: MAC to port

Switch devices again: open SW2, go to the CLI tab, and get to SW2#. You are going to read the full MAC address table. Use the MAC address you copied from R1 and manually find it here.

show mac address-table

The tells you where the switch learned a device at Layer 2. If the device is behind another switch, the port may be an , not the final .

Packet Tracer may not support every real IOS MAC-table lookup variation. In this lab, use the full show mac address-table output and manually match the MAC address from ARP to the port shown in the Ports column.

The detective path

Known ticket detail: PRINTER1 IP is 192.168.20.50.

Open R1, enter privileged EXEC mode, and run this command:

ping 192.168.20.50

Still on R1, run this command:

show arp

Expected result in the known-good lab: 192.168.20.50should appear in the ARP output after the ping. Copy its MAC address before you switch to SW2. If it does not appear, verify PRINTER1's IP settings and default gateway before continuing.

Open SW2, enter privileged EXEC mode, and run this command:

show mac address-table

If you copied a MAC address from R1, find it in the Mac Address column, then copy or write down the port listed in the Ports column. In the known-good lab, the matching MAC should point to Fa0/3, the PRINTER1 access port.

Stay on SW2 and run this command:

show interfaces status

Find the Fa0/3 row and read the VLAN column, then run this command:

show running-config

In that output, find interface FastEthernet0/3.

This is how commands become a workflow instead of flashcards. Ask one question at a time and let the answer choose the next command.

The important habit is sequencing: IP address first, then MAC address, then switchport, then port configuration and VLAN.

MAC tables age out: if a device is offline or silent, the switch may not currently have its MAC address. Generate traffic by pinging the device from the gateway or wait for it to speak.

Checkpoint

  • You can explain where ARP fits and where the MAC address table fits.
  • You can follow an IP address to a MAC address to a switchport.
  • You know why an uplink result may not be the final endpoint port.

Hands-On Practice

Use PRINTER1 as the fake ticket device and follow IP to MAC to switchport.

Your checklist and answers are saved locally in this browser.

Generate Traffic

Find The Port