先到最上層找

	switch-xxx>ping 1.2.3.4
	Type escape sequence to abort.
	Sending 5, 100-byte ICMP Echos to 1.2.3.4, timeout is 2 seconds:
	!!!!!
	Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
	switch-xxx>show arp | inc
	switch-xxx>show arp | include 1.2.3.4
	Internet 1.2.3.4 3 8888.aaaa.cccc ARPA Vlan4
	switch-xxx>

然後去底下 switch 找兇手

	lan-2960>show mac ad
	lan-2960>show mac address-table | inc
	lan-2960>show mac address-table | include 8888.aaaa.cccc
	4 8888.aaaa.cccc DYNAMIC Gi0/10
	lan-2960>