1. 找出该IP 所对应的MAC 地址

知道了IP地址，就知道了它所在VLAN的网关，通过查看网关的ARP 缓存表可以找出该IP 所对应的MAC 地址。比如我们要查找10.3.6.106这个IP，我们找到它所在的VLAN网关10.0.3.254，登陆网关后：

R04_Soft>ping 10.3.6.106

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.3.6.106, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R04_Soft>show arp | in 10.3.6.106
Internet 10.3.6.106              1   000f.fee6.2012 ARPA   Vlan202

这样我们就得到了它的MAC地址：00-0f-fe-e6-20-12

2. 在交换机上找出MAC 地址所对应的端口

R04_Soft>show mac-address-table dynamic address 00-0f-fe-e6-20-12
Unicast Entries
vlan   mac address     type        protocols               port
-------+---------------+--------+---------------------+--------------------
202    000f.fee6.2012   dynamic ip,ipx,other          GigabitEthernet3/3

这样我们就得到了它的目标端口GigabitEthernet3/3。我们可以看看这个端口所连设备的详细信息。
R04_Soft>show cdp nei Gi3/3 de
-------------------------
Device ID: B03S55
Entry address(es):
IP address: 10.0.3.55
Platform: cisco WS-C2960G-24TC-L, Capabilities: Switch IGMP
Interface: GigabitEthernet3/3, Port ID (outgoing port): GigabitEthernet0/21
Holdtime : 125 sec

Version :
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEAS
E SOFTWARE (fc1)
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Wed 12-Oct-05 22:05 by yenanh

advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=0000000
0FFFFFFFF010221FF000000000000001873A56C80FF0000
VTP Management Domain: 'cs'
Native VLAN: 1
Duplex: full
Management address(es):
IP address: 10.0.3.55
Unidirectional Mode: off

显然这是一个交换机，那么我们进入这台下层交换机10.0.3.55继续追查

B03S55>show mac-address-table dynamic address 00-0f-fe-e6-20-12
Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
202    000f.fee6.2012    DYNAMIC     Gi0/23
Total Mac Addresses for this criterion: 1

B03S55>show cdp nei Gi0/23 de
-------------------------
Device ID: B03S57
Entry address(es):
IP address: 10.0.3.57
Platform: cisco WS-C2960-24TT-L, Capabilities: Switch IGMP
Interface: GigabitEthernet0/23, Port ID (outgoing port): GigabitEthernet0/1
Holdtime : 148 sec

Version :
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEAS
E SOFTWARE (fc1)
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Wed 12-Oct-05 22:05 by yenanh

advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=0000000
0FFFFFFFF010221FF0000000000000018194DCB80FF0000
VTP Management Domain: 'cs'
Native VLAN: 1
Duplex: full
Management address(es):
IP address: 10.0.3.57

显然这又是一台下层交换机 = -|||，我们继续往下。
要说明的是我们还可以通过确认该mac是否是这个端口唯一活动mac地址来明确是否是该MAC地址所在端口，比如：

B03S55>show mac-address-table dynamic interface gi0/23
Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
1    0018.194d.cb81    DYNAMIC     Gi0/23
1    0018.194d.cbc0    DYNAMIC     Gi0/23
202    0001.6c96.21a5    DYNAMIC     Gi0/23
202    000f.fee6.2012    DYNAMIC     Gi0/23
202    0012.3fcd.2121    DYNAMIC     Gi0/23
202    0012.3fcd.24c7    DYNAMIC     Gi0/23
202    0012.3fcd.2508    DYNAMIC     Gi0/23
202    0015.58e5.3898    DYNAMIC     Gi0/23
202    0015.58e5.3933    DYNAMIC     Gi0/23
202    0015.58e9.efb0    DYNAMIC     Gi0/23
202    0019.d14f.e0fd    DYNAMIC     Gi0/23
202    0019.d14f.e34e    DYNAMIC     Gi0/23
202    001a.6b65.ef77    DYNAMIC     Gi0/23
202    001b.b981.6c84    DYNAMIC     Gi0/23
202    001b.b984.6afd    DYNAMIC     Gi0/23
202    0021.85ce.b813    DYNAMIC     Gi0/23
202    0021.9719.dc12    DYNAMIC     Gi0/23
202    0024.811f.abbf    DYNAMIC     Gi0/23
202    005b.484f.0d53    DYNAMIC     Gi0/23
--More--

显然不是 = =。我们继续往下查下层交换机10.0.3.57

B03S57>show mac-address-table dynamic address 00-0f-fe-e6-20-12
Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
202    000f.fee6.2012    DYNAMIC     Fa0/22
Total Mac Addresses for this criterion: 1
B03S57>show mac-address-table dynamic interface Fa0/22
Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
202    000f.fee6.2012    DYNAMIC     Fa0/22
Total Mac Addresses for this criterion: 1

这个IP地址在这个交换机的22口上，接下来你可以干你想干的事了......