Keeping a map of IP, Mac and Port number

[lordan]

Hi all,

We have a network with a number of Cisco 2950's and a proxy server. There is no router on the network. I want to be able to keep a map of the IP and MAC addresses of all machines that are connected to any of the switches. I also want this to be mapped against the port number on the switch. I need to be able to compare these values to previous values, so that I can see if a MAC address has moved to a different port on the switch, or a MAC has a new IP address.

It thought it should be reasonably simple to write a script to do this. Since I'm not very good at SNMP I took a look at cammer.pl, which gets close to doing what I want. Since we don't have a router, I entered the IP of our proxy server as the router IP. It seems to work, except that I don't get a list of all the machines that are connected to the switch. I get a few, so I'm guessing that I'll only get the ones that happen to be active at that particular time.

I also ran snmpwalk from a terminal, as well as a few snmpgets. I'm getting some of the information I need, but not all.

So my question is this, is there any way of getting a list of switch port #, MAC address and IP address? I was thinking of putting the script up as a cronjob. If it is, could somebody give me an idea of how I get the information? Or is there already some (open source) tool that does exactly this job?

Thanks for any help,
Lorenzo

[w1r3sp33d]

I am a huge fan of solar winds, which admittedly is not freeware and definately overkill but you can get a demo version to try it out.

The total price for the engineer edition is still under a grand so it is fairly easy to expense or budget for most organizations once you see how useful it can be in troubleshooting and monitoring.

In my experience it pays for itself the first time you need it (I have bought several copies for different companies.)

http://www.solarwinds.net/Tools/Engineer/index.htm

[lordan]

Thanks. I've also looked a SolarWinds. The issue is that if we are going to purchase anything, it really needs to be open source. It's a matter of organizational policy, and not only my personal preference.

But I'd still prefer to write a ruby or perl script myself. It shouldn't be too complex. Just that SNMP isn't giving my all the information I need. :-(

[w1r3sp33d]

I am encouraged by your policy! I am afraid I can't help with what you are looking for, but I will be REALLY excited if anyone knows of a good network discovery package that runs under linux.

Here is another option, but it could be adminstratively heavy to setup:
-collect macs out of switches, check them to machine name
-set mac address security on the switchports to desktops, servers, and printers
-put desc on each switchport once it is locked down
-set an ip reservation to each mac in DHCP

1pc = 1mac = 1 ip = 1 port

If you have more than a handful of machines this would be too unyeildy to control.

[kc0arf]

Hello,

I too would love to expirement with such a tool!

Christian

[SpannerB]

You should be able to get everything you need from SNMP, but you will have to ping all devices on the network before trying to get the information as the switch doesn't cache MAC addresses indefinitely.

If you want an alternative way to script it, then you could ping all devices on the network, grab the output from an arp -a and then create a telnet session to each switch, run the command:
show mac-address-table
and grab the output.

This would give you IP against MAC address, and MAC address against switch port. Then you'd just have to tidy up the results a bit.

I did write a program for Windows that did this and gave a graphical output of the switches, however as we moved to using VLANs, getting ARP information only works for the same network segment - so it become next to useless for us and I stopped development.

Cheers
Ben

[Osiris123d]

I think what you want is SNMPWalk. Search for SNMPWalk.exe or if you have linux download the package. You will have to learn how to find the data you want from ALL the stuff snmpwalk gives you, but what you want is in the data somewhere

[bwbrooks2031]

I am looking into developing a similar application. Currently I use Solarwinds and find it very effective, though I want a little more customization then what this offers. I have developed a network monitoring solution mostly in PHP. The problems I have run into in developing a switch port map is that not all switches operate in the same manor. If all of your switches are Cisco 950s you may have an easier time then I. What you may want to look into is the atTable OID: 1.3.6.1.2.1.3.1 I believe Cisco switches do use this and it may hold what you need. Something you may also want to look into is the BRIDGE-MIB, I am not sure of the OID right now. One other place would be the ipNetToMediaTable OID: 1.3.6.1.2.1.22. Hopefully this will help point you in the direction. If you find any more useful information let me know. With the mixture of switches we have here, I have run into a lot of hurdles.