Using SNMP retrieve MAC addresses of directly connected machines to a switch

Question

I want to get MAC address of machines directly connected to a switch using SNMP. I am querying dot1qTpFdbPort for this. But this returns all the MAC addresses learned by switch which includes machines which are not physically connected to this switch but are learned by switch.

How do get MAC addresses of only those machines which are physically connected to ports on switch?

My goal is to figure out all the machines which are physically connected to a switch.

I am using a non cisco switch. But I want to implement a generic method for all boxes.

 [root@dani ~]# snmpwalk  -c public -v 2c 192.168.48.1 **sysDescr**
 SNMPv2-MIB::sysDescr.0 = STRING: **3Com Baseline Switch 2928-SFP Plus**
 Software Version 5.20 Release 1101P10

Answer 1

There is no way for a switch to determine whether the device plugged in to a particular port is an 'end host' or a second switch with many end hosts. You could, guesstimate, that if multiple MAC addresses are learned on a single port, then that port is connected to another switch. But that leaves you open to misidentifying a connection to another switch with only one other host behind it as a host (and not an actual switch).

You would have to depend on some extra configuration on the switch, to identify whether the port is connected to an end-host, and if so, pull the MAC address table for that interface.

For example, if you pull a list of all the interfaces, and determine which of them are marked as "Portfast" (or "Edge" ports, for non Cisco gear). That is almost a guarantee of that particular interface being connected to an end host (just almost, see below comments by MikePennington and others), and then when you pull the full MAC address table, filter it to just 'store' the data on the portfast/edge ports.

Answer 2

This information is very dated.

https://supportforums.cisco.com/discussion/10356006/lldp-info-snmp

Quick search revealed a LLDP-MIB in the Cisco SNMP Object Navigator. The above link makes me question which switches, if any, actually support this object. Perhaps it's worth a look... It may only get your local switch information, not neighbor info. You could guesstimate as other posters stated above by using SNMP to determine if a port is in trunk mode and combine that with the number of learned MAC addresses per interface to improve your odds.

http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&step=2&mibName=LLDP-MIB

Answer 3

A switch only knows which port a MAC address is behind. Not whether there are other switches between it and the host with that MAC address.

You could filter the port/mac data you gather to ports with MAC addresses counts below a threshold. The downside of that approach is that some MACs may not appear in your data at all (e.g. unmanaged switch on someones desk, VM setups that result in one host having multiple MACs) or may appear more than once (if the total devices behind a switch is less than your threshold).

A more subtle approach would be to gather the MAC/port data from all your switches to produce a list of MAC addresses behind every switchport. Then look for the shortest list that contains each MAC address. This will represent the switchport closest to the device (occasionally you may get duplicates if a switch has only one port in use but it shouldn't be too hard to resolve these manually). If you find a lot of MACs with the same closest switchport you probablly need to gets someone to investigate what is on the end of it.