1. Find out the MAC address corresponding to IP: You can find out a MAC address corresponding to IP by looking at the ARP cache table of the system. Because ARP cannot be carried out across vlans, MSFC, a routing module connecting VLANs, is the best choice-generally, it has an interface vlan n in each VLAN, which can correctly interpret ARP. 6509msfc # ping10.10.1.65 Type the escape sequence to abort. Send 5, 100 bytes of ICMP Echos to10.10./0.65, timeout 2 seconds:! ! ! ! ! The success CatOS is 100%(5/5), min/avg/max =1/4ms6509msfc # showarp | in10.1.65internet/kloc. (Enabled) Display cam 00-06-29-73-12-1d * = static entry. += Permanent entry. # = system entrance. R = router entry. X = port security entry $ = dot1x security entry VLAN destmac/routedes [cos] destination port or VCs/[ protocol type]-200-06-29-73-12-1d 9/4/ Total matching cam entry displayed by kloc-0/[ALL] = 1 Does this mean that the IP of the machine is 10. 10.65438? If the following command shows that there is only one active MAC address on this port, the answer is yes: 6509SE & gt (enabled) shows cam dynamic 9/4 1 * = static entry. += Permanent entry. # = system entrance. R = router entry. X = port security entry $ = dot1x security entry VLAN destmac/routedes [cos] destination port or VCs/[ protocol type]-200-06-29-73-12-1d 9/4/ Kloc-0/[ALL] shows the total number of matching cam entries = 1 If the command shows that there are multiple active MAC addresses on this port, this port should be connected to other switches or hub devices. See the following example (find the switch port with IP10.10.1.250): 6509msfc # ping10.1.250 type escape sequence to Send 5 10. 10.65438-byte ICMP response! ! ! ! The success rate was 100%(5/5). Round trip min/avg/max =11ms6509msfc # showarp | in10.1.250Internet/kloc-0. += Permanent entry. # = system entrance. R = router entry. X = port security entry $ = Dot 1x security entry VLAN Dest MAC/Route Des [CoS] destination port or VCs/[ protocol type]-200-09-6b-8c-64-EC 3/11[all] shows the match. (Enabled) Show cam dy 3/ 1 1 * = static entry. += Permanent entry. # = system entrance. R = router entry. X = port security entry $ = Dot 1x security entry VLAN destination MAC/ routing Des [CoS] destination port or VCs/[ protocol type]-100-03-E3-4b-06-80 3/1. 00-08-02-E6-B0-CD 3/1[all] 65438 200-09-6b-8c-64-EC 3/1[all]/kloc- Kloc-0/00-08-02-E6-B0-A93/1[All]1nBecause the port is connected to another switch or hub, it must be tracked as follows: 6509SE & gt (enable) show CDP Nei3/ #-indicates duplex mismatch. Port device -ID port -ID platform-3/11Cisco2924 Gigabit Ethernet11ciscows-c2924m-xlThis command shows that the opposite device is cisco2924. If it is not displayed, it means that other manufacturers' equipment is connected, and it may be necessary to continue tracking in a similar way on this switch. In this case, it is a Cisco device. So we can continue: 6509 se> (enable) show CDP Nei3/11deport (our port): 3/1/device-ID: Cisco 2924 device address: IP address:1. Kloc-0/53 second function: TRANSPARENT_BRIDGE SWITC H version: Cisco Internet operating system software IOS (tm) C2900XL software (C2900 Inc. Compiled Mon 17-Jul-00 1 7:35 by ayounes platform: cisco WS-C2924M-XL Port-ID (port on neighbor device): Gigabit Ethernet11VTP management domain: lan local VLAN: 1 Duplex: complete system name: unknown system object ID: unknown management address: unknown physical location: unknown Cisco2924# display mac address table dynamic 2 non-static address table: destination address address type VLAN destination port-0009.6b8c.64EC dynamic 2 FastEthernet 0/2 According to the above command, The MAC address 0009.6b8c .64EC is connected to the Cisco 2924 switch, and it is the only active MAC address on this port, so the machine with IP10.1.250 should be connected to this port. Excerpt from lovelintao's publication