How to find out the IP address of the switch in a configured rather big network?

Question

network hardware

It has such, approximately, a rack (figure)
It has 4 managed switches (40.28, 40.29, 40.30, ...), the web face of one of which could not be found either in the masterpiece files of previous admins, or through the arp -d sequence , " long command to fill the cache in the range 192.168.40.* ", arp -a | find /i " * poppy address * ", despite the fact that everything works fine with the other three switches.
The MAC address of the *missing* switch is known (it was used to check), but it cannot be found either on the gateway or via arp. Perhaps it was somehow changed, but by searching all the addresses from arp it was not possible to detect the poor fellow.
The question is, can this be done somehow brutally locally, simply through a patch cord, for example, by picking up, and asking directly (if it doesn’t sound stupid and it’s really possible). Maybe there is some other way to expose this tomboy.
ps 41.16 in the figure is not a switch (so, for show)

Answer 1

an ideal spherical switch in a vacuum, or is it still a finite model?
of the options - cdp, lldp, console (if locally brutal)

Answer 2

tcpdump ether host, fping -ag XX.XX.XX.XX/XX on the subnet it is on.