Locate a host on Network

Question

What is the best method of locating a particular workstation on a VLAN ?

I sometimes need to do this, if a workstation IP address, shows up on an ACL Deny

1. torrent use
2. High bandwidth usage (Top Talkers)

3. Snort alert

   The way I do it now,

   • Logon to a core switch in the same VLAN
   • Ping the IP address,
   • Retrieve the MAC from the ARP table
   • Mac address lookup to see which switch it was learned from
   • logon to that switch rinse and repeat until I locate the workstation

sometimes this can take logging in to ~7 switches, there are specific challenges to this network that I can do nothing about at the moment. Huge VLANs (/16) with a few hundred users on each VLAN

in an all Cisco shop, with minimal budget using Cisco switches, there must be a more efficient way to track down host machines ?

EDIT: To add further details

Specifically I'm looking for the switch-port the user is connected to ? also some history would be great .. because my approach only works while the user is still connected, and no value when i review the logs in the morning, but the device is no longer connected.

There is no central DNS or Active Directory it is like a Guest Network, where only internet access is provided. I try to provide some management and a bit of security.

I've tried "show ip dhcp binding | inc " it gives me a strange MAC (with 2 extra characters) that is not the associated device MAC, I have not looked into this yet, but ARP is accurate and I'm more concerned with finding the switch port the offending machine is connected to.

hope this provides some clarification

Answer 1

Take a look at Layer2 traceroute (for cisco).. Cdp should be running btw...

Router# traceroute mac 0000.0201.0601 0000.0201.0201
Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)
con6 (2.2.6.6) :Fa0/1 => Fa0/3
con5                 (2.2.5.5        )  :    Fa0/3 => Gi0/1
con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2
con2                 (2.2.2.2        )  :    Gi0/2 => Fa0/1
Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)
Layer 2 trace completed
Router# 
Router# traceroute mac 0001.0000.0204 0001.0000.0304 detail 
Source 0001.0000.0204 found on VAYU[WS-C6509] (2.1.1.10)
1 VAYU / WS-C6509 / 2.1.1.10 :
                Gi6/1 [full, 1000M] => Po100 [auto, auto]
2 PANI / WS-C6509 / 2.1.1.12 :
                Po100 [auto, auto] => Po110 [auto, auto]
3 BUMI / WS-C6509 / 2.1.1.13 :
                Po110 [auto, auto] => Po120 [auto, auto]
4 AGNI / WS-C6509 / 2.1.1.11 :
                Po120 [auto, auto] => Gi8/12 [full, 1000M] Destination 0001.0000.0304 
found on AGNI[WS-C6509] (2.1.1.11) Layer 2 trace completed.
Router# 

Answer 2

We use the mactrack plugin on Cacti to do such things. Works quite well, historical data is also available.

As long as the ARP and MAC address tables are available via SNMP then it works. The only small problem we had is where the layer 3 instance for a site is an ASA. We just worked around this by pulling the ARP table via scripts and generating an arpwatch file, since mactrack supports that.

Example screenshot from our setup:

Imgurl link: https://i.sstatic.net/mZjS2.png

Answer 3

There are a couple of ways to do this on the cheap (the exercise of research and/or implementation I'll leave up to you).

1. Have a script that logs in to each one of your edge devices and grabs the MAC address tables off of them. You'll want to exclude trunk interfaces for this, but it would be trivial to create a hash (or dict for you python people) with the keys being the edge switches and the values being another hash that's basically "mac.addr -> interface". This will eliminate the need for you to chase down MACs on your edge switches, which is most of the legwork it seems. I can recommend using Perl's Net::Appliance::Session or Python's exscript to make this happen (this assumes you have access to a *NIX box).

2. Use SNMP to query this data, which will eliminate the need for a script to actually log in to switches and run commands. You're on your own to look up MIBs for the MAC address tables, but here's a Google search to get you started.

3. If you're on Windows only, you can use SecureCRT or TeraTerm to set up macro's to "half-automate" this for you, but my experience with either of those is very limited, so YMMV.

Hope that gives you some ideas.

Answer 4

I like to have a script that grabs show arp and show cam dyn output every 15 minutes, I timestamp it with term exec prompt timestamp so we have a rough correlation for times. Then I append all switch output to a file... one file per switch, per day.

All these logs are kept in the same directory for easy grepping.

Finding hosts becomes a fairly simple grep exercise if you know the topology... Stuck in windows without grep? Use cygwin...

Answer 5

Why not simplify things and do an nslookup on the IP, grab the hostname from DNS and use the hostname to find the computer via an asset list or management database? Or if you don't have reverse DNS setup you could log into the DHCP server to pull the host name.

I know it isn't a Cisco/CLI method, but it should work if your users are assigned to computers 1-1. If you are many to 1, you can use Windows/Linux tools to find out the current user of the computer.

Answer 6

You're doing it the same way I would do it manually.

There is software out there that will take the manual steps out of it for you. A tool included in SolarWinds Engineering Toolkit will, although unfortunately it's not cheap. I'm sure there are other alternatives.

If you're down for an in-between solution or some scripting work, take a look at the SNMP commands issued in this answer for an idea of how you could script it from a system with a CLI SNMP client

Edited to add: I presume that your "rinse and repeat" is not re-including the ping and whatnot along the way. Once you've determined the mac address you should be able to just do sh mac addr | in #### (whoops angle brackets disappear)

Answer 7

You are asking two things.
1.Locate a MAC on your network - I advise to create a script (php) and use SNMP to query all MAC address-table to give you the switch/port where is located the IP/MAC address.

2.Monitor Usage of your (torrent use,High bandwidth usage (Top Talkers),Snort alert) - Use a solution as ntop to monitor the flows on your network. I'd used this a long ago and was great.

Answer 8

Just a suggestion... if you have some sort of active syslog inspection that can trigger on specific events, you could write a script to SNMP lookup the IP on every switch so know where it was roughly around the time the event happens.

(sorry, I cannot find the exact OIDs)

Edit: link "Using SNMP to Find a Port Number from a MAC Address on a Catalyst Switch" I forgot about the comm@vlan trick. There are a lot of tables to ping to find all the information needed for a human. :-(

Answer 9

switchmap is another tool which can be used to keep track of which mac address is behind which switchport (amongst other things).

Answer 10

I've used netdisco to collect this information. It will allow one to query the data base with a hostname, IP address, MAC address, etc. and return the switch and switchport. It will do some other useful things as well.

Answer 11

You might find this link helpful

http://arunrkaushik.blogspot.com/2007/10/traceroute-mac-ip.html