DownloadTraceMAC is a Windows/Linux command-line tool that allows you to trace a specific MAC address thru Cisco switches.
It works by connecting to a switch using SSH, SNMP, Telnet, HTTP or HTTPS and do some "show commands" and later process the output, this will happen recursively until it finds the switch where that MAC address (PC/Printer/Etc) is directly connected.
Note: It works with Cisco switches only and you must have CDP enabled at least on trunks/links between switches!
Is tested with Cisco switches:
Catalyst: 2960,3560,3750,4948,6509,9200,9300,9500 (All protocols)
Nexus: C9332C, 93180YC-EX (NX-OS SSH)
Express 500 (HTTP)
FYI: It uses Nbtscan.exe (NetBIOS) as a alternative method to discover the mac address of a host and now seems that it is considered a malware. Anyway it is just a simple network tool that can scan the network similar to NMAP or Angry IP Scanner, etc...
Features
- Supports multiple protocols: SSH, SNMP v1/2c/3, Telnet, HTTP, HTTPS
- Has no limit for the maximum number of hops identified in the path
- Does not require a source MAC address
- Can search directly the MAC address or its IP Address/Hostname
- Can use a external device: Cisco Ro/L3 SW/PIX/ASA or Linux machine; for MAC lookup
- Is showing the interface description where the MAC was found
- Support for Linux and Windows
Project Samples
License
GNU General Public License version 2.0 (GPLv2)Follow TraceMAC - Traceroute for MAC addresses
User Reviews
-
Hi, Great job ! It work fine on windows platform. Ideas to improve your program : encrypt password into tracemac_cfg.ini file and provide a new switch to use encrypted password instead of a static one into .ini file. For example : tracermac.bat aa:bb:cc:dd:ee:ff -pmd5=<md5_hash_for_password> <local_router_ip> In another project (sshmate), developer use md5hash.exe to encrypt password. Another way to do this would be to provide interactively user and password to use to connect to switch (prompt), the password would be hidden when you type it. It would also be nice to be able to hide the snmp community and use snmp v3. Tof.
-
Hi there, I have problems with the ssh login (username/password). Telnet works fine, but I get the error message with ssh (same login credentials) Another problem with the trace... When more switches are involved (Sw1 > Sw2 > Sw3...), the trace only shows the first hop, but repeats more than 100 times (I terminated the batch job). All switches are Cisco Catlyst 2960 series... Any ideas?Reply from TraceMAC - Traceroute for MAC addressesPosted 2021-12-04
Hi. Thanks for asking and sorry for my delay. I assume you used the windows version. The first issue could be related to how Plink works. (I've updated it in the last version) The second one is strange, could be related to Windows UAC or it doesn't correctly parse the output from the switch. I need more info to troubleshoot. What type of switch is? Exact part-number If you still use it please check the last version to see if there are any improvements