Wednesday, November 30, 2011

Query your Switch using SNMP and Linux

So you want to query a switch using snmp to see which MACs are being seen on which ports. In that case you will need the BRIDGE-MIB. On Centos-5 it is supplied, but as part of the 'libsmi' package.

# rpm -qa | egrep 'libsmi|net-snmp' | sort

So you need to create file '/etc/snmp/snmp.conf' and configure as follows:

# cat /etc/snmp/snmp.conf
mibdirs +/usr/share/mibs/ietf

Then you should have success with the following command.
Remember to use the correct community string - by default its usually 'public'.
And the mib object name IS case sensitive.

# snmptable -v1 -c public -Cbw 80 -IR BRIDGE-MIB::dot1dTpFdbTable
SNMP table: BRIDGE-MIB::dot1dTpFdbTable

Address Port Status
0:c:29:45:21:9e 24 learned
0:c:29:79:6c:73 24 learned
0:12:3f:c3:9d:7b 19 learned
0:14:38:a2:70:7e 15 learned
0:14:5e:68:74:ed 17 learned
0:1b:78:22:bc:30 21 learned
0:26:55:e7:5b:f4 27 learned
0:50:56:a7:61:32 22 learned
64:31:50:cd:c7:0 0 self
9c:8e:99:19:99:a6 23 learned
9c:8e:99:c4:46:56 13 learned
c8:4c:75:90:f:e0 28 learned

Status 'self' or 'mgmt' is the MAC of the switch itself - used for the management connection.

If you have a modular switch, you may want to check the logical to physical port name mapping, as show next. If you just have a simple switch, the port names are usually boring!

# snmpwalk -v1 -c public -IR IF-MIB::ifName | head -n 5
IF-MIB::ifName.1 = STRING: 1
IF-MIB::ifName.2 = STRING: 2
IF-MIB::ifName.3 = STRING: 3
IF-MIB::ifName.4 = STRING: 4
IF-MIB::ifName.5 = STRING: 5

Before you run the above commands, it may be useful to ping every host on your subnet, just so that the switch has seen everything. You can use 'nmap' for that:

# nmap -n -sP

Good luck with the above. I've often found these command very useful!