Ali,
The information you need to extract is easily done, I just hope your referring to a Cisco switch

I used our Cisco Lab's 2950 Catalyst switch to perform this small presentation :wink:
Considering you've got a Cisco switch (2900 series and above) and our wanted host is '192.168.0.2' according to your traffic analysis, you can use the following commands to obtain the information you're after:
[code:1]Firewall.cx#ping 192.168.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms[/code:1]
This command will ensure the switch finds the device with the appropriate IP address and save it into its ram.
[code:1]Firewall.cx#show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.2 0 00c0.9fb7.72f4 ARPA Vlan1
Internet 192.168.0.200 - 0008.2199.4100 ARPA Vlan1[/code:1]
This command will reveal the MAC address of the device we are looking for. In this example, IP Address 192.168.0.2 is associated with MAC address 00c0.9fb7.72f4 .
Next, we need to find out which port maps to this MAC address:
[code:1]Firewall.cx#show mac-address-table
Mac Address Table
Vlan Mac Address Type Ports
----
----
1 0002.b33c.3268 DYNAMIC Fa0/7
1 0090.d0eb.dfc4 DYNAMIC Fa0/7
1 00a0.c9ab.0e8f DYNAMIC Fa0/7
1 00c0.9fb7.72f4 DYNAMIC Fa0/1
Total Mac Addresses for this criterion: 4[/code:1]
As you can see, we've discovered that our wanted MAC address/Device is connected to Fast Ethernet port No.1 !
If you require further information or help, please do let us know.
Cheers,