How to trace MAC address

Traceroute is a tool for measuring the route path and transit times of packets across an Internet Protocol (IP) network.

Traceroute sends a sequence of Internet Control Message Protocol (ICMP) packets addressed to a destination host. Tracing the intermediate routers traversed involves control of the time-to-live (TTL) Internet Protocol parameter. Routers decrement this parameter and discard a packet when the TTL value has reached zero, returning an ICMP error message (ICMP Time Exceeded) to the sender.

In a Data Center, it is often required to find a host and the layer2 path. To do it, Cisco has implemented a good tool: traceroute mac.

The traceroute mac command output shows the Layer2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and an error message appears.

See you the example to understand how this feature works. Suppose to have two host (192.168.0.4, 192.168.0.6) and you would find the layer2 path using the Ciscozine-SW1 Switch.

How-to-trace-a-MAC-address

 

Below the MAC address table and the ARP table of the Ciscozine-SW1 switch:

You have two options to find the path between two hosts:

  1. Trace using the MAC address
  2. Trace using the IP address

In the first case, use the command ‘traceroute mac 0019.9955.0f60 00a0.6011.aa0b’

In the second case, use the command ‘traceroute mac ip 192.168.0.4 192.168.0.6’

… and to have more detail about the trace use the ‘detail’ option:

Below the video with the example:

https://youtu.be/IgX6Ij_GXf4

Remember:

  • For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.
  • When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.
  • The maximum number of hops identified in the path is ten.
  • Layer 2 traceroute supports only unicast traffic.
  • The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN.
  • The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port).
  • This feature is not supported in Token Ring VLANs.
  • The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs.
    • If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path.
  • If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. The IP addresses must be in the same subnet. If the IP address is not resolved, the path is not identified, and an error message appears.

 

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-1_14_ea1/command/reference/3750cr/cli3.pdf