finding the IP address of switch

[Fred Martin_1]

I have discovred a switch on my network for which I don't have any records of the IP address or hostname. I don't see anything in my DNS files that looks like it might be the switch, but DNS may have a measleading or incorrect hostname for that IP.

I can't bring it down for days but would like to know what the IP address is.

I do have the mac address, taken off a label which is on the unit itself.

Can I use arp or something like that to get it's IP address?

I've done 'arp -a' and scoured the listing for the mac but haven't found it.

[Kent Ostby]

Fred --

Try :

arp -an

[Fred Martin_1]

That's excellent, except that in the output I don't see the mac address listed, which is labeled on the switch. I'm certain it's the original label. This is a 3Com, they're clearly marked.

As I understand it, there will only be an address in arp if some activity has put it there, right?

Is there something I can do from unix, using the mac address, that will cause an arp entry? Then I could retreive the IP from that.

[Kent Ostby]

It's odd that its not in the ARP output if you are connected to that switch.

Any possibility that the mac addresses have been changed?

Is there a serial port on the switch that you can hook a laptop into and check the config.

Are there other entries in the arp output that have IP addresses that you can't match anywhere else?

[Jim Mallett]

Is there a serial console on the switch that you can plug into, possibly to get a management console?

How about the other side of the switch? Do you know what hosts reside there? If so, pick one of them and do a traceroute to it. I have a switch here that I cannot ping and does not show up in my arp cache, but when I traceroute a host on the other side it sure shows up.

Jim

[Fred Martin_1]

Yes I can connect to the serial port. I was hoping to avoid that, it's at a remote branch office :)

Actually there are lots of IPs not showing in the arp listing (I'm getting 97 lines of data and I have many more hosts than that).

I always assumed that IPs only showed up in the arp table under certain circumstances, unkown to me, and so never expected everything to show up there.

[Fred Martin_1]

Well that was interesting. As usual in the forum I have backed myself into the dunce corner :)

I knew the name of a host that is connected to the switch at the remote site. So, I did a traceroute from here to the host.

No IP address... it hops right from the router on to the host.

I am forced to conclude that this is not a managed switch but a dumb hub, and has no IP address.

That certainly explains the lack of paperwork.

[Fred Martin_1]

Or not. None of my switches, even the managed ones with IPs, show on a traceroute.

So I'm back to wondering if there's a way other than the serial port, of getting the IP.

[Patrick Wallek]

If you know what subnet it is on or know a host that is attached to the switch, do a ping to the entire subnet and then check the arp table.

Say the switch and a host are on the 170.170.2 network.

# ping 170.170.2.255

Let it run through the hosts on the network a couple of times. CTRL-C to stop the ping and then:

# arp -a

and look for the MAC address of the switch.

[Bill Hassell]

The management IP address is seldom used and the arp cache only remembers active IP and MAC addresses. Until you actually connect to that IP address, no arp entry will be created. So the only way to find the address is to hook up a serial cable and use that port for the information. Hopefully the switch doesn't have an unknown password.