I have a Cisco switch and a big list of servers on the network. I need to determine what servers are connected directly to that switch. Will searching for the MAC address of each server in the switch's arp table (show ip arp) assure me that the device is directly connected? If not, is there any other way?

I might also need to do the same for a Cisco router, I guess the answer would be the same. Please, correct me if I'm wrong.



The arp table lists for each interface, which MAC is (directly or indirectly) reachable via that interface. That may be a single directly connected device per interface. If you have several switches, you should ignore the "trunk" lines between switches in your counting: Every MAC reachable indirectly via the connected switch wll be listed there. If you even have redundant links between your switches, a specific MAC may be listed only with one of several possible trunk links, depending on which link is currently considered best. Finally, note that a MAC may not be listed if no traffic with that device has passed the switch yet; typically, at least at boot time they will talk something to the net (e.g. DHCP) and thus "tell" their MAC.

In summary: For interfaces with directly connected devices, your guess should be fine. Just make sure to drop info from links to wother switches.

EDIT: While explaining the arp table in general, I missed the point of your final question: For a router the visibility of a MAC may be less prelevant: Since there will typically be a switch between the router and any other device on the connected LANs, a packet from that device will reach the router only if the device taklks to the router specifically (e.g. in order to reach another net via that router) or vice versa. Thus a router may never learn MACs of devices in the LAN that never bother to talk to any non-LAN host.

  • Thanks, Hagen! Just additional question to see if I understand: if I find a server's MAC in the ARP table of a switch, would it mean that they are somehow in the same location (room or cage)? – Megaslav Feb 8 '13 at 14:55
  • Just note that you may want to ping sweep the subnets on the switch before reviewing the ARP table. You can usually tell if there is an interconnected switch via multiple ARP entries stored on the same port (per VLAN). – mbrownnyc Feb 8 '13 at 14:58
  • 1
    @Megaslav You can't say anything about the exact location (unless you know where the cables run), but if you find the MAC of device B on host A, then they are on the same broadcast domain (i.e. at most some switches between them, no routers). I run a five-storey network and of course the servers in the basement have practically all client MAC of the house in their arp table, but none from external hosts. Similarly, switches leaarn MACS from all traffic through then, so the switch in 3rd floor may not know the 4th floor MACs, but those from the servers (and the public printer on 2nd floor). – Hagen von Eitzen Feb 8 '13 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.