Speaker A
Discovery: finding devices in the switch network by time. We're done here. You will be able to locate a device in the network down to the switchport level. I've got to be honest, I've kind of fallen in love with our paper napkin network diagram that we have here on the screen. Every nugget, I'm like, "Oh, I need to make this look professional and label everything," and I'm like, "You know, this is just so real and gritty. I like it." We're now approaching the end of this IT expert series, and my mission this entire time is to give you the core of switching, meaning 90% of the switch networks that you're going to run into are going to encounter exactly what we've run into in this series. Outside of VLANs, which I told you was going to be a completely separate series just focused on that technology, and there have been a lot of topics that have made their way into my brain, and I'm like, "Oh, I should talk about that." I'm like, "No, no, that's fringe. That's not the 90. That isn't everything," except for this idea of discovery. It comes at you many different ways in a network environment. You might have a server, and that server is acting up, and you go, "I wonder if that's a network issue," and you think to yourself, "Where is that plugged in?" Or maybe you've got a bandwidth hog on the network. Somebody's sucking up all the internet bandwidth, and you find out what IP address it is from your firewall or internet reporting or however you figure out who that person is, and you think, "Oh, it's the guy with the computer named Bob's PC." Now, where is Bob's PC? These are just two examples of hundreds that I could come up with on locating devices in the network. Now, once again, I'm going to point you back to the documentation and say if we had a full, clear documentation, I'm going to keep going back to that statement where we went through originally and documented every port and what it was connected to. A lot of those issues would resolve themselves simply by looking at the documentation. But you will encounter situations where either there is no documentation or the documentation isn't updated, or you've got a foreign device in your network that simply wouldn't be documented. The last puzzle piece that I want to give you in this series is the ability to find network devices even if you have good documentation, bad documentation, or no documentation at all. So let's come back to the situation I was mentioning just a moment ago. There's a server, and we want to know where it's plugged in, and that's a very real situation. Right now, we have a server at this office named BBUS 3001-03. Now, that's the hostname of the Windows server. A lot of people call that the DNS name. Our first milestone is to try and figure out what IP address that has. Sometimes it's really easy, and sometimes it's a challenge. If you're plugged into the same network as the server, you may be able to just ping it. Ping BBUS 3001-03. In this case, it comes back and says, "Here's the server, and here's its IP address." The reason why is because DNS was able to resolve that. I could also type in nslookup, which is a great little utility where this server is the DNS server, and I could type in that hostname like that. Now, I just typed in the name without any domain after. It's like, "Well, I don't know who that is. I need to type in the fully qualified domain name like this," and it comes back and says, "Oh, that's 10.225.1.252." If all you have is a name and nslookup and ping don't work, you're going to have to resort to some grittier techniques like logging onto that server, typing in ipconfig, working with a Windows admin. Something you can't be left completely in the dark. As soon as you have an IP address, you're going to be able to ping that and get its MAC address. Watch this. Ping 10.225.1.252 comes back and says, "Hey, I'm replying all day." Now, the way that happens is my computer actually sent out an ARP message that said, "Hey, 10.225.1.252, what is your MAC address?" That's a broadcast, and everybody got that, including the server, and the server came back and said, "Here's my MAC address," and then my computer pinged it. So my computer, behind the scenes, knows what the MAC address of this server really is. I can find that out by typing in arp -a, and it gives me a list of all the different devices that it's seen on the network and the MAC addresses that it's cached, meaning kept in memory. And right there, there's my server, 10.225.1.252, and there is the MAC address, the golden piece of information. I'm going to right-click on that to copy it to my clipboard, and we need to have some kind of starting point with the switch. Now, we've got this paper napkin network diagram that we've been building the entire time, so we're very familiar with the network environment. But even if we're not, you need to be able to get onto some switch somewhere as a starting point. So again, that may be a console port. That may be some nitty-gritty techniques if you're just walking into a network environment that you don't know. But most of the time, you'll find some IP address that you have to begin. I'm going to start right here with Suite 4 Switch 2. I don't know where that server is in the network, but we're about to find out. I'm going to open my command prompt again, telnet to 10.225.1.243, which is that switch. Now, you can do this from the graphic interface. It's just not as fast, and you definitely don't look as cool if somebody's looking over your shoulder. I'm going to log in with the username Cisco, type in the password, and I'm there at the prompt. Now, I copied that server's MAC address to the clipboard. I'm going to paste it into Notepad so I don't lose it. Now, we know this whole network. We've been drawing it on the paper napkin behind us this entire series, but I want you to pretend like we don't. Imagine just like this command prompt and Notepad are blocking all the diagram behind it. Imagine the only thing that we know is that we have this switch number two. The command I'm going to type in is show mac address table, and I'll hit the question mark, and it says you can either look at an interface to find out what MAC addresses are under it, a certain VLAN, but the one that I'm after is a specific MAC address. So I'll type in address, and then it says, "Well, what specific MAC address do you want to type in?" Now, notice it's giving me the option of all these different formats. That's because depending on the operating system, you may see all kinds of formats of MAC address. Some people will put dashes between them. That's most often Windows. Some devices will put colons between them instead. I see that all the time on Linux. And some devices will put periods, and instead of every two characters, that'll do it every four like that. These are all the same thing. They're all a 12-character MAC address. It's just what format does it take. Now, this switch is very kind to us in the sense that it accepts any one of those formats, but that's why the question mark is also handy because you may be on a switch platform that only takes this one or this bottom one or whatever the case. So I'm going to copy that top one to the clipboard and paste it into place. I hit the Enter key. Now, this switch says, "Well, wait a second here. This MAC address is actually on port Gi28." Now, you and I who know this network diagram immediately go, "No way. It's not on port 28. Port 28 connects to another switch." But remember, from this switch's perspective, it does see it on port 28, meaning my computer is right here somewhere. I don't know what port it's on, and when I pinged that device, this switch saw the reply come back in port 28. So from all it knows, it's thinking, "Well, that server must be somewhere over there," or at least from this switch's perspective, it knows to reach that server, I've got to go out that port. But that's the behind the scenes. Remember, you and I are not supposed to know what this network looks like. Oh man, I got a drink in it. Time me out. Let me tell that back in there. So what if we didn't have this network diagram? What if I mean, how would we know that this wouldn't be the server itself plugged into that w?
