The purpose of this page is to help you improve the quality of the results you are getting from the Switch Port Mapping Tool. Typically users see MAC Addresses without many matching IP addresses. This is because most switches operate at layer 2 (MAC address level) and do not track IPv4 or IPv6 addresses. There is no magic protocol to obtain a MAC address given an IP address, so we have to go the other way - find the MAC addresses for known IP addresses.
You may have received a poor IP/MAC address ratio,
ie. you are not getting as many IP addresses to match
the MAC addresses as you would like to see.
As we
mentioned above, there is no magic protocol to find an
IP address given a MAC address. But there is a protocol
to find the MAC address given an IP address - it's
called ARP. The only caviat is that ARP is valid only
for the subnet you are on, in other words, ethernet uses
the MAC addresses to communicate between devices on a
subnet and if the packet goes outside the subnet, it
uses the MAC address of the default gateway. The default
gateway then routes your outgoing packet to other
network segments.
IP addresses are found in the
Switch Port Mapper by matching the MAC addresses the
switch reports with MAC addresses found in the ARP
tables of the four sources we can access. Be sure that
you are using all four: query local computer, query
switch and query two other devices.
You can
improved the IP to MAC matching ratio by selecting one
or two SNMP enabled routers or servers to query for ARP
tables. These devices need to be aware of the devices
that are attached to the switch, ie. in the same
network. A Cisco 6509 is a great source of well
populated ARP tables.
Beginning with version 2.10, Ping Sweep has been greatly enhanced to
better locate devices on your local subnet - we made Ping Sweep
ranges saved by Switch Group. This means that one switch
can have a set of IPs pinged while another switch can
have a different set of ranges. Ping Sweep may
prepopulate routers and switch ARP tables with the
IP/MAC addresses of active targets.
Use it, but use it
carefully. If you have a class C (254 device) subnet, it generally
takes only a few seconds to determine the IP/MAC address of each
active device on the subnet. However, if you are on a class A
(16,777,214 device) network, scanning can take forever. What we
recommend is that you ping only ranges of networks that you
know have active devices. Do not waste time pinging empty ranges.
Use the Ping Sweep Editor carefully to set up the ranges you want to
ping - several smal ranges are better than one huge range. Be sure to turn on the Enable Ping Sweep checkbox.
Another reason you should use Ping Sweep is NetBIOS.
Every responding device is tested for NetBIOS
responses. Windows and Apple Mac computers often respond
(if allowed to and not firewalled) with the MAC address
information. We save that information in the Combined
ARP Table to use to find the IP address for a given MAC
address.
If you have a network where many devices have statically assigned IPv4 addresses (such as printers, switches, routers, WAPs) you can enter those IP/MAC address pairs into the database. You can import a static ARP table. Create the ARP table by saving a text file with one IP/MAC address pair per line. The IP address is first followed by a space or tab character, then the MAC address. Save import your static ARP file, click on Database Management and then click on Import ARP Table - follow the directions. These static entries are retained and not cleared from the Combined ARP Table on program exit.