How to trace MAC address
Traceroute is a tool for measuring the route path and transit times of packets across an Internet Protocol (IP) network.
Traceroute sends a sequence of Internet Control Message Protocol (ICMP) packets addressed to a destination host. Tracing the intermediate routers traversed involves control of the time-to-live (TTL) Internet Protocol parameter. Routers decrement this parameter and discard a packet when the TTL value has reached zero, returning an ICMP error message (ICMP Time Exceeded) to the sender.
In a Data Center, it is often required to find a host and the layer2 path. To do it, Cisco has implemented a good tool: traceroute mac.
The traceroute mac command output shows the Layer2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and an error message appears.
See you the example to understand how this feature works. Suppose to have two host (192.168.0.4, 192.168.0.6) and you would find the layer2 path using the Ciscozine-SW1 Switch.
Below the MAC address table and the ARP table of the Ciscozine-SW1 switch:
Ciscozine-SW1#sh mac-address-table dynamic Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 1 000e.d7e3.0880 DYNAMIC Fa0/1 1 000e.d7e3.0881 DYNAMIC Fa0/1 1 0014.a968.f0b1 DYNAMIC Fa0/48 1 0019.9955.0f60 DYNAMIC Fa0/21 1 0026.22eb.3bef DYNAMIC Fa0/1 1 00a0.6011.aa0b DYNAMIC Fa0/1 Total Mac Addresses for this criterion: 6 Ciscozine-SW1#
Ciscozine-SW1#sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.0.1 65 0014.a968.f0b1 ARPA Vlan1 Internet 192.168.0.4 0 00a0.6011.aa0b ARPA Vlan1 Internet 192.168.0.5 1 0026.22eb.3bef ARPA Vlan1 Internet 192.168.0.6 1 0019.9955.0f60 ARPA Vlan1 Internet 192.168.0.253 - 000e.d7d0.cd80 ARPA Vlan1 Internet 192.168.0.254 69 000e.d7e3.0880 ARPA Vlan1 Ciscozine-SW1#
You have two options to find the path between two hosts:
- Trace using the MAC address
- Trace using the IP address
In the first case, use the command ‘traceroute mac 0019.9955.0f60 00a0.6011.aa0b’
Ciscozine-SW1#traceroute mac 0019.9955.0f60 00a0.6011.aa0b Source 0019.9955.0f60 found on Ciscozine-SW1 1 Ciscozine-SW1 (192.168.0.253) : Fa0/21 => Fa0/1 2 Ciscozine-SW2 (192.168.0.254) : Fa0/1 => Fa0/27 Destination 00a0.6011.aa0b found on Ciscozine-SW2 Layer 2 trace completed Ciscozine-SW1#
In the second case, use the command ‘traceroute mac ip 192.168.0.4 192.168.0.6′
Ciscozine-SW1#traceroute mac ip 192.168.0.4 192.168.0.6 Translating IP to mac ..... 192.168.0.4 => 00a0.6011.aa0b 192.168.0.6 => 0019.9955.0f60 Source 00a0.6011.aa0b found on Ciscozine-SW2 1 Ciscozine-SW2 (192.168.0.254) : Fa0/27 => Fa0/1 2 Ciscozine-SW1 (192.168.0.253) : Fa0/1 => Fa0/21 Destination 0019.9955.0f60 found on Ciscozine-SW1 Layer 2 trace completed
… and to have more detail about the trace use the ‘detail’ option:
Ciscozine-SW1#traceroute mac ip 192.168.0.4 192.168.0.6 detail Translating IP to mac ..... 192.168.0.4 => 00a0.6011.aa0b 192.168.0.6 => 0019.9955.0f60 Source not directly connected, tracing source ..... Source 00a0.6011.aa0b found on Ciscozine-SW2[WS-C3550-48] (192.168.0.254) 1 Ciscozine-SW2 / WS-C3550-48 / 192.168.0.254 : Fa0/27 [auto, auto] => Fa0/1 [auto, auto] 2 Ciscozine-SW1 / WS-C3550-48 / 192.168.0.253 : Fa0/1 [auto, auto] => Fa0/21 [auto, auto] Destination 0019.9955.0f60 found on Ciscozine-SW1[WS-C3550-48] (192.168.0.253) Layer 2 trace completed. Ciscozine-SW1#
Below the video with the example:
- For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.
- When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.
- The maximum number of hops identified in the path is ten.
- Layer 2 traceroute supports only unicast traffic.
- The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN.
- The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port).
- This feature is not supported in Token Ring VLANs.
- The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs.
- If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path.
- If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. The IP addresses must be in the same subnet. If the IP address is not resolved, the path is not identified, and an error message appears.
- 'The Pirate Bay' Co-Founder Found Guilty in Denmark's Largest Hacking Case: The co-founder of The Pir... http://t.co/bWr7rYyfBq #hackers
- Zombie: This is a small post about Zombie. This post will provide you some insight on Zombie. Zombie... http://t.co/S3YWytfM1R #security
- APT28 — State Sponsored Russian Hacker Group: Nearly a decade-long cyber espionage group that targete... http://t.co/aaisiRuWWx #hackers
Enter your email address to receive notifications of new posts.