pjhtech Tools
Cisco · Cisco IOS XE

Find a Device on a Cisco Switch: CDP, LLDP, ARP and MAC Commands

Quick answer #

Start with the endpoint's IP-to-MAC mapping on its gateway, then look up that MAC in the relevant VLAN on the switching path. Use CDP or LLDP to identify neighboring switches when the MAC points to an uplink. These tables answer different questions; none alone is a complete endpoint inventory.

Scope: Traditional Catalyst Layer 2 switching with an IOS XE IPv4 gateway. System-management command baseline: Catalyst 9600 17.16.x. Overlay fabrics, proxy ARP and centralized wireless forwarding need additional context.

Read-only commands #

Read-only commands
Cisco IOS XE · Authorized EXEC mode; context specified below

Read-only

Replace these example values: 192.0.2.10.

show ip arp 192.0.2.10
Read-only

Replace these example values: 0011.2233.4455.

show mac address-table address 0011.2233.4455
Read-only

Replace these example values: 120.

show mac address-table vlan 120
Read-only

Replace these example values: GigabitEthernet1/0/10.

show mac address-table interface GigabitEthernet1/0/10
Read-only
show cdp neighbors
Read-only
show cdp neighbors detail
Read-only
show lldp neighbors
Read-only
show lldp neighbors detail

Choose the right table #

ARP relates an IPv4 neighbor address to a link-layer address in the gateway's local context. The MAC table relates a learned source MAC and VLAN to a forwarding interface. CDP and LLDP provide advertised information about directly connected neighbors, such as device identity and remote port. Neighbor discovery is not a list of every client behind that neighbor.

Workflow #

  1. Confirm the endpoint's current IP address and VLAN. A historical DNS answer or an expired DHCP lease can send the search down the wrong path.
  2. Obtain its MAC address from the actual gateway or another authoritative endpoint record. Use the correct VRF when the gateway keeps separate routing contexts.
  3. Look up that MAC on the switch and retain the VLAN as part of the result. If the entry points to an uplink or port-channel, identify its neighbor and repeat on the downstream switch.
  4. Stop when the evidence reaches an access-facing port, then check what is attached. A phone, hypervisor, small switch or bridged device may place several MAC addresses behind that one port.
  5. Record the complete path and timestamp. A correct result today may change after a user moves desks, a virtual machine migrates or a wireless client roams.

Interpretation pitfalls #

An empty table is not proof that the host does not exist. The host may be silent, an entry may have aged out, discovery may be disabled, or the lookup may be running in the wrong forwarding context. A switch without the endpoint's gateway role may have no ARP entry for it at all.

For a remote routed destination, the local ARP entry normally concerns the next hop, not the remote host's MAC. Do not trace that next-hop MAC and label the resulting router port as the host's physical location. Return to the endpoint's own subnet before beginning the Layer 2 search.

Useful tools and references #

  • IPv4 subnet calculator: Check whether the endpoint belongs to the gateway's directly connected subnet before expecting a local ARP mapping.

Sources

Documentation reviewed: 8 October 2026