OT: query routers tables

[Jamie Bohr]

This question is way off topic, sorry.  I have googled and googled and have
not come up with a answer to my question.

I want to query a switch (via SNMP I think) to get a list of systems
attached to it.  I am using Nagios and would like to determine switch/router
dependencies.  Trace route will not work because it will not show
routers/switches for systems on the same sub-net as the system doing the
trace route and I have seen where it does not return the network based
switch a system is attached to, just the router.  If I could get a list
systems attached to a router/switch (not a personnel switch, a managed
switch) I can correlate the information and build dependencies.  I have a
hand-held Fluke network tester than runs Linux that will do this for me when
I type in a hostname, I would rather do it programmaticly because I have
over 300 systems I need to do.  I am open to any method that works that I
can script so I don't have to do it every time a new system appears.  Just
in case it matters some systems are attached to a V-lan off a managed switch
and I do NOT have admin rights to the routers or switches.

-- 
Jamie Bohr

[Mogens Kjaer]

Jamie Bohr wrote:
>  This question is way off topic, sorry.  I have googled and googled
> and have
>  not come up with a answer to my question.
>  
>  I want to query a switch (via SNMP I think) to get a list of systems
>  attached to it.  I am using Nagios and would like to determine 
>  switch/router
>  dependencies.  Trace route will not work because it will not show
>  routers/switches for systems on the same sub-net as the system doing the
>  trace route and I have seen where it does not return the network based
>  switch a system is attached to, just the router.  If I could get a list
>  systems attached to a router/switch (not a personnel switch, a managed
>  switch) I can correlate the information and build dependencies.  I have a
>  hand-held Fluke network tester than runs Linux that will do this for me 
>  when
>  I type in a hostname, I would rather do it programmaticly because I have
>  over 300 systems I need to do.  I am open to any method that works that I
>  can script so I don't have to do it every time a new system appears.  Just
>  in case it matters some systems are attached to a V-lan off a managed 
>  switch
>  and I do NOT have admin rights to the routers or switches.
>   
I wrote a C program that uses SNMP for this.

It queries the switches and hubs for the MAC addresses
seen at each port and the number of bytes in/out.

Some switches have a MAC to IP table, else I would
ask the ARP table of the router for a table like this.

The program then prepares a nice top-10 on the
intraweb showing which computers are generating
most traffic, and another table with traffic
at each switch/hub port.

This program was made by studying the output from
snmpwalk for the switches, finding the necessary
MIB's etc.

The program is unreadable by anyone else
but me, so it is not suitable for distribution, but
maybe this could give you a hint on how to proceed.

Mogens

-- 
Mogens Kjaer, Carlsberg A/S, Computer Department
Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
Phone: [phone], Fax: [phone]
Email: mk(a)crc.dk Homepage: http://www.crc.dk

[Jamie Bohr]

That would be great.  It has been awhile since I have done C programming so
it would be nice to work with it again.

Thank you,
  Jamie Bohr

On 1/3/07, Mogens Kjaer <mk(a)crc.dk&gt; wrote:
>  Jamie Bohr wrote:
>  > This question is way off topic, sorry.  I have googled and googled and
>  have
>  > not come up with a answer to my question.
>  >
>  > I want to query a switch (via SNMP I think) to get a list of systems
>  > attached to it.  I am using Nagios and would like to determine
>  > switch/router
>  > dependencies.  Trace route will not work because it will not show
>  > routers/switches for systems on the same sub-net as the system doing the
>  > trace route and I have seen where it does not return the network based
>  > switch a system is attached to, just the router.  If I could get a list
>  > systems attached to a router/switch (not a personnel switch, a managed
>  > switch) I can correlate the information and build dependencies.  I have
>  a
>  > hand-held Fluke network tester than runs Linux that will do this for me
>  > when
>  > I type in a hostname, I would rather do it programmaticly because I have
>  > over 300 systems I need to do.  I am open to any method that works that
>  I
>  > can script so I don't have to do it every time a new system
>  appears.  Just
>  > in case it matters some systems are attached to a V-lan off a managed
>  > switch
>  > and I do NOT have admin rights to the routers or switches.
>  >
>
>  I wrote a C program that uses SNMP for this.
>
>  It queries the switches and hubs for the MAC addresses
>  seen at each port and the number of bytes in/out.
>
>  Some switches have a MAC to IP table, else I would
>  ask the ARP table of the router for a table like this.
>
>  The program then prepares a nice top-10 on the
>  intraweb showing which computers are generating
>  most traffic, and another table with traffic
>  at each switch/hub port.
>
>  This program was made by studying the output from
>  snmpwalk for the switches, finding the necessary
>  MIB's etc.
>
>  The program is unreadable by anyone else
>  but me, so it is not suitable for distribution, but
>  maybe this could give you a hint on how to proceed.
>
>  Mogens
>
>  --
>  Mogens Kjaer, Carlsberg A/S, Computer Department
>  Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
>  Phone: [phone], Fax: [phone]
>  Email: mk(a)crc.dk Homepage: http://www.crc.dk
>
>  --
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>  


-- 
Jamie Bohr

[Les Mikesell]

On Wed, 2007-01-03 at 15:47 +0100, Mogens Kjaer wrote:

>  > This question is way off topic, sorry.  I have googled and
> googled and have
>  > not come up with a answer to my question.
>  > 
>  > I want to query a switch (via SNMP I think) to get a list of systems
>  > attached to it.  I am using Nagios and would like to determine 
>  > switch/router
>  > dependencies.  Trace route will not work because it will not show
>  > routers/switches for systems on the same sub-net as the system doing the
>  > trace route and I have seen where it does not return the network based
>  > switch a system is attached to, just the router.  If I could get a list
>  > systems attached to a router/switch (not a personnel switch, a managed
>  > switch) I can correlate the information and build dependencies.  I have a
>  > hand-held Fluke network tester than runs Linux that will do this for me 
>  > when
>  > I type in a hostname, I would rather do it programmaticly because I have
>  > over 300 systems I need to do.  I am open to any method that works that I
>  > can script so I don't have to do it every time a new system appears.  Just
>  > in case it matters some systems are attached to a V-lan off a managed 
>  > switch
>  > and I do NOT have admin rights to the routers or switches.
>  > 
>  
>  I wrote a C program that uses SNMP for this.
>  
>  It queries the switches and hubs for the MAC addresses
>  seen at each port and the number of bytes in/out.
>  
>  Some switches have a MAC to IP table, else I would
>  ask the ARP table of the router for a table like this. 
OpenNMS (http://www.opennms.org) does this if you enable
it.

>  The program then prepares a nice top-10 on the
>  intraweb showing which computers are generating
>  most traffic, and another table with traffic
>  at each switch/hub port. 
Ntop (http://www.ntop.org) will do nice summaries of traffic
by hosts/ports/whatever for whatever systems are bridged
to the collecting port.

-- 
  Les Mikesell
   lesmikesell(a)gmail.com

[Mogens Kjaer]

Mogens Kjaer wrote:
...
>  I wrote a C program that uses SNMP for this. 
I was asked how I did this:

The code is written for
many generations of D-Link hubs and switches -
the first version of the program is nearly 10 years old. The
D-Link switches/hubs each have their own way of returning
the information I want.

So the code has ended up being very clumsy
and unreadable - sometimes even by myself :-)

To figure things out, I used snmpwalk (from net-snmp-utils):

snmpwalk -v 1 -cpublic -m ALL -Cc yourswitchname >somefile.txt

If the command doesn't return anything, you either don't have
access or the community string "public" is wrong. This is set
up on the switch.

You'll see lines like:

RFC1213-MIB::ifInOctets.1 = Counter32: 294511
RFC1213-MIB::ifInOctets.2 = Counter32: 484607327
RFC1213-MIB::ifInOctets.3 = Counter32: 629120408
RFC1213-MIB::ifInOctets.4 = Counter32: 3390066466
RFC1213-MIB::ifInOctets.5 = Counter32: 2848975069
RFC1213-MIB::ifInOctets.6 = Counter32: 0
RFC1213-MIB::ifInOctets.7 = Counter32: 72355738
RFC1213-MIB::ifInOctets.8 = Counter32: 0
...

this is the number of bytes received on the ports 1-8.

Similar ifOutOctets.

I analyse lines like:

RFC1213-MIB::ipNetToMediaPhysAddress.196609.172.20.0.1 = Hex-STRING: 00 
05 5D EF 4F 6E
RFC1213-MIB::ipNetToMediaPhysAddress.196609.172.20.0.2 = Hex-STRING: 00 
05 5D EF 4E 68
...

to get a correlation between IP: 172.20.0.1 and MAC
address: 00:05:5D:EF:4F:6E

Our NAT router runs Linux (this is also where this program
runs), so I can read the arp table in /proc/net/arp
to get the MAC/IP correlation as well.

Note, if you only get numeric responses, like:

SNMPv2-SMI::mib-2.17.4.4.1.5.24 = Counter32: 0

instead of:

BRIDGE-MIB::dot1dTpPortInDiscards.24 = Counter32: 0

it's because you're missing the relevant MIB file.

In some cases the MIB files are found on (in my case)
D-Link's home page, some MIB files are more general -
google is your friend.

Put the MIB files in a a folder and set the environment
variable MIBDIRS to point to that folder before starting
snmpwalk.

Some switches hide the relevant information in a private
section, this can be listed like:

snmpwalk -v 1 -cpublic -m ALL -Cc nameofswitch 
.iso.org.dod.internet.private.enterprises

(this is on one line).

With this information it is possible to walk all ports
on all switches and get the necessary information:

Traffic in/out
MAC address seen on port
correlate MAC address with IP number

and finally do a reverse DNS lookup to get the hostname
from the IP number.

Mogens

-- 
Mogens Kjaer, Carlsberg A/S, Computer Department
Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
Phone: [phone], Fax: [phone]
Email: mk(a)crc.dk Homepage: http://www.crc.dk