Log / retrieve Cisco Switch traffic info

[1etherer]

Hi,

I wanted to know if there is a way to log and retrieve traffic on a cisco switch.

At our company we had someone use a unauthorized laptop last night and it created a loop in the network which shutdown certain areas of the office.

I wanted to know if there is a way to see when and what info I can get from the cisco switch. I dont work with them so dont know much about them, I just want to try and give my team a hand.

Even if its a MAC address history of all devices and times it was logged, something along them lines.. At the moment I don't know which model it is, but they upgraded them around 2 years ago.

Cheers

 

[1etherer]

Ok found this guide, How to Track Down What Switch Port a Device is Plugged Into (Cisco Switches) - Peters Blogs and the cmd seems simple as show mac address (which will deplay all MACs), Is there a way to find out when the MACs were logged? and any other info?

 

[bob442]

you might want to look into some sort of NPS which would prevent issues like you described. But that can be complicated depending on your network. Maybe a remote syslog would be a good place to start.

 

[iParanormalx]

You can do show hosts which will show cached hosts... but rather than doing it CLI on the switch you might want to check the DNS server. Also if the laptop was granted an address it would be on your DHCP log. Although if when it was hooked up it created a loop then it might not have even gotten that far.

 

[1etherer]

Ok, thanks for your advise

 

[carnageX]

So where can bob and iParanormal send the bill to for helping you with your work?

 

[iParanormalx]

So where can bob and iParanormal send the bill to for helping you with your work?

I'll bill his source IP's most recently known domain whois...

 

[iParanormalx]

It really was crazy that the post you're referring to got as far as it did. It's not related to this OP at all and my opinion likely is irrelevant but i feel like it should have been better moderated.. by definition moderate means to make or become less extreme, intense, rigorous, or violent.. and we clearly saw an abuse in the lack of moderation. I <3 u carnage but sometimes you need to step up as a moderator and exercise your power and delete posts to cater the experience for users. If you don't have the permissions to do that then that is a flaw of the system.

 

[setishock]

Isn't there a way to setup a watchdog that would have the MAC's of authorized systems on the network? If a new MAC appears it would disconnect it and sound an alert? (You'd have to have a way to introduce a new MAC incase of new equipment being installed.)

What's going to happen to the person when they get caught up with? With Paris, I'd be really leary about unauthorized devices on my network. I'd make an example out of the person once caught.

 

[1etherer]

So where can bob and iParanormal send the bill to for helping you with your work?

Not my remit, I just want to give a hand... And understand

Everyone knows tech side of things you always need help as you can't know everything

When I'm a consultant for IT I won't need to know the technical stuff, just generally how they work and what's best infrastructure, solutions, products.