You can monitor traffic for a specific IP on a core switch using embedded packet capture, MAC-to-IP mapping via ARP tables, or NetFlow, depending on your switch model and configuration.

1. Using Embedded Packet Capture (EPC)

Many modern Cisco switches, such as Catalyst 9300 series, support embedded packet capture. This allows you to capture packets directly on the switch without connecting an external sniffer. You can filter captures by source or destination IP, VLAN, or port. Steps generally include:

• Enter privileged EXEC mode (enable) and configure a capture buffer.
• Define a capture filter for the specific IP.
• Start the capture and review the packets, including source/destination IPs and ports.
• Stop the capture to avoid CPU impact, as continuous capture can affect switch performance .

2. Mapping IP to MAC and Switch Port

Since switches operate at Layer 2, they track MAC addresses, not IPs. To locate traffic for a specific IP:

• Use the ARP table on a router or Layer 3 interface to find the MAC address associated with the IP (show ip arp).
• On the switch, check the MAC address table to see which port the MAC is connected to (show mac address-table address <MAC>).
• This allows you to identify the port where the device is connected and monitor traffic on that port .

3. Using NetFlow or sFlow

For core switches that route traffic, NetFlow or sFlow can provide detailed traffic statistics:

• Configure NetFlow on the switch to export flow data to a collector.
• Filter flows by the specific IP to see traffic volume, source/destination, and ports.
• This method is less intrusive than packet capture and suitable for ongoing monitoring .

4. Quick Counters and Interface Monitoring

If you only need a high-level check:

• Use show ip interface to check input/output packet counts for interfaces.
• Ping or test connectivity to the IP (if allowed) to see if traffic is reaching the switch.
• This method does not show packet details but can confirm activity .

Recommendations

• For detailed packet inspection, use embedded packet capture with filters for the IP.
• For port identification, combine ARP and MAC address tables.
• For long-term traffic analysis, implement NetFlow or sFlow.
• Always stop captures after use to prevent CPU overload on the core switch. By combining these methods, you can effectively monitor and analyze traffic for a specific IP on a core switch without relying solely on external packet sniffers.