[c-nsp] Identifying device(s) connected to cisco L2-only switch

[Jeffrey Denton]

On Sat, Nov 1, 2008 at 9:48 PM, Dale Shaw <dale.shaw+cisco-nsp at gmail.com> wrote:
> Hi all,
>
> Here's the scenario:
>
> - L2 switchport in cat3750 "up/up"
> - No MAC learnt on the interface ("sh mac-addr int gi1/0/4" shows no
> dynamic MAC address)
> - Attached device not necessarily configured with an IP in the correct
> VLAN (mismatched with switchport) - endpoint IP configuration unknown
>
> I haven't really given this much consideration, but does anyone know
> of any tricks, ideally executed _from_ the switch, to encourage the
> attached device to spit back a frame? Essentially I want/need to
> figure out what's attached. Even knowing the MAC vendor would help.
>
> Other suggestions are welcome. I guess I could try things like a
> broadcast ping from a host in the same VLAN, make the port a trunk and
> madly ping sweep, but something more elegant would be nice.
>
> A physical inspection, in this case, is not possible.

Nothing elegant...

You could always shutdown the port and wait for someone to complain.

If it's not randomly generating traffic, then it's not a windows box.
Switches tend to be noisy with layer 2 protocols.  Firewall or
UNIX/Linux based system?  Does the duplex and speed show up as
auto-negotiated (a-full, a-100)?

You could try "no switchport" and the "ip add dhcp" on the interface
to see if you can generate a response that way.  Set an IP on the
interface so that you can "ping 192.168.1.255 source ...".  Pinging
broadcast addresses might speed up the process.

Setting up a SPAN or RSPAN might help you capture some traffic.

"test cable-diagnostics tdr interface ..." would at least tell you how
long the cable is.

Setup the port as a trunk or port-channel or .... with
auto-negotiation and see what happens.

Set the switch up as a management cluster and then run "show cluster members".

Use the other suggestions....