network speed

The network is the forum.

Moderators: Steel, notfred

Re: network speed

Postposted on Tue May 27, 2014 7:07 pm

From the switch MAC table you should know what MAC addresses are on what ports and then dump the ARP table from a computer and see what IP lines up to that MAC. If the MAC isn't in the ARP table try a quick broadcast ping to help populate the table.
notfred
Grand Gerbil Poohbah
 
Posts: 3726
Joined: Tue Aug 10, 2004 10:10 am
Location: Ottawa, Canada

Re: network speed

Postposted on Wed May 28, 2014 10:51 am

If you're using DHCP you should be able to correlate the MAC address table to the Address Leases as well.

And I have to second having things labeled correctly. While you're doing this would be a really good time to start labeling. :)
curtisb
Gerbil
 
Posts: 30
Joined: Tue Mar 30, 2010 11:27 pm

Re: network speed

Postposted on Wed May 28, 2014 11:24 am

Here's why you need to label.

User turns on a DHCP server on their network drop. You can tell from the packets which MAC address it comes from and then from the switch port MAC table which port it is connected to. You can now unplug that port to save your network from their bad DHCP server, but without labelling you have no target for you to deploy the LART on.
notfred
Grand Gerbil Poohbah
 
Posts: 3726
Joined: Tue Aug 10, 2004 10:10 am
Location: Ottawa, Canada

Re: network speed

Postposted on Thu May 29, 2014 10:33 am

Can you use the management aspect of the switch to get the MAC address connected and then look up the IP from the ARP table?
<caveat>I've never used a managed switch myself before.</caveat>
Usacomp2k3
Gerbil God
 
Posts: 21291
Joined: Thu Apr 01, 2004 4:53 pm
Location: Orlando, FL

Re: network speed

Postposted on Thu May 29, 2014 10:55 am

In theory, yes, you can do that. However, VLANs can span switches and in a multi-switch, multi-VLAN, multi-routed environment, the IP address will only appear in the ARP table on the switch where the gateway is configured. If the PC is not directly connected to that switch, then the IP address will be associated to the uplink port of the switch with the gateway. This is why I mentioned bouncing the MAC address off of your DHCP leases to find the computer name.

Of course, there is another way to do this. If you know the name of the computer you're looking for, you can always run nbtstat -a <computername> to get the remote computer's MAC address, then search the forwarding database (MAC table) on the switch to find which port it's associated to.

Always work from the bottom up of the OSI model. If you can't figure out it out Layer 1, then move to Layer 2...which would be to find the MAC address. As long as the link is active, the MAC should appear in the forwarding database and show what port it's on. IP's come into play at Layer 3, but see my note above on figuring out which port it's plugged into.

There are other ways to figure this out with higher-end managed switches and their associated management applications, but you'll pay A LOT more for them.
curtisb
Gerbil
 
Posts: 30
Joined: Tue Mar 30, 2010 11:27 pm

Re: network speed

Postposted on Thu May 29, 2014 10:59 am

curtisb wrote:In theory, yes, you can do that.

Would also have helped if I would have noticed page 2 before commenting *sigh* need coffee.
Usacomp2k3
Gerbil God
 
Posts: 21291
Joined: Thu Apr 01, 2004 4:53 pm
Location: Orlando, FL

Previous

Return to Networking

Who is online

Users browsing this forum: No registered users and 7 guests