• A Network Switch Mapping Solution

Purpose of this page

The purpose of this page is to help you improve the quality of the results you are getting from the Switch Port Mapping Tool. Typically users see MAC Addresses without many matching IP addresses. This is because most switches operate at layer 2 (MAC address level) and do not track IPv4 or IPv6 addresses. There is no magic protocol to obtain a MAC address given an IP address, so we have to go the other way - find the MAC addresses for known IP addresses.

Carefully Selecting your Server/Router 1/2 Devices

You may have received a poor IP/MAC address ratio, ie. you are not getting as many IP addresses to match the MAC addresses as you would like to see.

As we mentioned above, there is no magic protocol to find an IP address given a MAC address. But there is a protocol to find the MAC address given an IP address - it's called ARP. The only caviat is that ARP is valid only for the subnet you are on, in other words, ethernet uses the MAC addresses to communicate between devices on a subnet and if the packet goes outside the subnet, it uses the MAC address of the default gateway. The default gateway then routes your outgoing packet to other network segments.

IP addresses are found in the Switch Port Mapper by matching the MAC addresses the switch reports with MAC addresses found in the ARP tables of the four sources we can access. Be sure that you are using all four: query local computer, query switch and query two other devices.

You can improved the IP to MAC matching ratio by selecting one or two SNMP enabled routers or servers to query for ARP tables. These devices need to be aware of the devices that are attached to the switch, ie. in the same network. A Cisco 6509 is a great source of well populated ARP tables.

Ping Sweep

Beginning with version 2.10, Ping Sweep has been greatly enhanced to better locate devices on your local subnet - we made Ping Sweep ranges saved by Switch Group. This means that one switch can have a set of IPs pinged while another switch can have a different set of ranges. Ping Sweep may prepopulate routers and switch ARP tables with the IP/MAC addresses of active targets.

Use it, but use it carefully. If you have a class C (254 device) subnet, it generally takes only a few seconds to determine the IP/MAC address of each active device on the subnet. However, if you are on a class A (16,777,214 device) network, scanning can take forever. What we recommend is that you ping only ranges of networks that you know have active devices. Do not waste time pinging empty ranges. Use the Ping Sweep Editor carefully to set up the ranges you want to ping - several smal ranges are better than one huge range. Be sure to turn on the Enable Ping Sweep checkbox.

Another reason you should use Ping Sweep is NetBIOS. Every responding device is tested for NetBIOS responses. Windows and Apple Mac computers often respond (if allowed to and not firewalled) with the MAC address information. We save that information in the Combined ARP Table to use to find the IP address for a given MAC address.

Static ARP Tables

If you have a network where many devices have statically assigned IPv4 addresses (such as printers, switches, routers, WAPs) you can enter those IP/MAC address pairs into the database. You can import a static ARP table. Create the ARP table by saving a text file with one IP/MAC address pair per line. The IP address is first followed by a space or tab character, then the MAC address. Save import your static ARP file, click on Database Management and then click on Import ARP Table - follow the directions. These static entries are retained and not cleared from the Combined ARP Table on program exit.