Use SNMP to find a device on Cisco

In my recent search for a rouge MAC address, I had dozens of Cisco switches to look through in order to find the port the address came from. I vaguely remembered hearing about someone using SNMP to track a MAC down to a specific port on a switch, and decided to take a look.

I found which detailed the process of finding the port owner of a MAC via SNMP. A summary of steps are below:

  • From Step 1, the MAC address is: = Hex: 00 00 0C 07 AC 08
  • From Step 2, the bridge port tells that the MAC address belongs to bridge port number 13: = 13 
  • From Step 3, the bridge port number 13 has ifIndex number 2: = 2
  • From Step 4, the ifIndex 2 corresponds to port Fast Ethernet 0/1:
    ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.2 = Fa0/1

Leave a Reply