---
title: "Detecting Switch Port"
slug: "packet-tricks-detecting-switch-port"
updated: 2026-02-28T08:09:42Z
published: 2026-02-28T08:09:42Z
canonical: "docs.fmad.io/packet-tricks-detecting-switch-port"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fmad.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Detecting Switch Port

Many times there is the question “what port on the switch is this plugged into”, that could be the capture interface or the management interface.

## Management Interface

To detect this the utility `pcap_switch` decodes the CDPv2 traffic and outputs it in JSON format per below.

```plaintext
sudo tcpdump -i phy10 -w - | pcap_switch | jq
```

The example output looks like

```json
{
  "Timestamp": "06:23:59.421.244.720",
  "Proto": "CDPv2",
  "TTL": 180,
  "TLV": [
    {
      "Type": "Device ID",
      "Length": 32,
      "Value": "sg2-r0719-tor9k()"
    },
    {
      "Type": "Address",
      "Length": 17,
      "Addresses": [
        {
          "Protocol": "IP",
          "Address": "192.168.1.1"
        }
      ]
    },
    {
      "Type": "Port ID",
      "Length": 16,
      "Value": "Ethernet1/32"
    }
  ]
}
```

Which can be extremely helpful in locating the switch and which port it is connected to.

## Capture Interface

To locate what port a capture interface is connected to, use the following

```plaintext
 sudo stream_cat --follow --frame "capture.port==0" | pcap_switch
```

Note: this assumes no traffic is being MIRROR/SPAN session traffic is on the capture port.