Currently you have to search the entire forwarding database table because the SNMP key contains the MAC address while the SNMP value contains the port number:
snmpbulkwalk -c public -v 2c switch 18.104.22.168.22.214.171.124.3.1.2 | grep "INTEGER: 123" 0.34.107.48.216.142 = INTEGER: 123 ^^^^^^^^^^^^^^^^^^^ MAC Address in decimal on port 123
Does a standard SNMP subtree containing a "Port -> MAC" association perhaps exist? Or is there a more efficient way to do this?
That way you would not have to
snmpwalk the switch but could concisely query for a certain port, which would certainly alleviate the load on the switch's CPU and also accelerate the queries.
I'm currently trying to find out what kind of burden a NAC (Network Access Control device) performing a MAC authentication would put on the devices.
Please don't tell me MAC auth is not secure. I know. But you have to start somehow.
I know you can also use Radius (which transmits the MAC address directly). Not sure however what would happen in that case when someone plugs in a "dumb" switch = more than one device/MAC.
Let's stick to the fact that this would be a generic NAC that receives snmp traps when the link comes up and then does its work.