10

I am trying to get a list of the devices that are connected to my Cisco (Catalyst 2960) switch. Preferably through SNMP. Here is what I've already done:

I was able to retrieve the ARP table from the switch (through SNMP walking OID 1.3.6.1.2.1.4.22.1.2 on the switch). However this does not reflect the 'live' set of IP's since ARP does not update when devices go offline. In other words, when I restart a device and it acquires a new IP address (dynamic) I end up with the old IP address also listed in my ARP table, even though that IP is not currently on the network.

Is there any way for me to find that 'live' list through the switch, preferably avoiding the ARP table?

P.S. I cannot continuously ping the devices to determine their status, I'm working under very low bandwidth conditions.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 3, 2021 at 5:52

4 Answers 4

Reset to default
7

Is a broadcast ping to the subnet from the SVI on the switch (which is low-bandwidth), and using show mac address-table dynamic out of the question?

some-switch#show mac address-table dynamic
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    000f.257b.ba3b    DYNAMIC     Gi1/0/49
   1    0011.254f.a5be    DYNAMIC     Gi1/0/49
  56    0000.0c57.aa00    DYNAMIC     Gi1/0/49
  56    0004.0ff4.8cf4    DYNAMIC     Gi1/0/49
  56    0004.0af4.c8fb    DYNAMIC     Gi1/0/5

At this point, use your ARP table to map from mac-address to IP address.

Doing this with SNMP is possible, but somewhat painful if you need to know what port each mac-address is on... use dot1dTpFdbAddress to grab the mac-addresses, dot1dBasePortIfIndex to map to interface ifIndex and then ifName to map from ifIndex to a name you'll recognize.

Improve this answer
7
  • Could you please expand more on the first solution? How can I do that? ... Also, dot1dTpFdbAddress and dot1dBasePortIfIndex are not returning anything :/
    – AJ J.
    Jun 24, 2013 at 18:37
  • 1
    I'm assuming you know how to show the mac-address table from the CLI... regarding the ping, if your subnet is 172.16.1.0/24 then a broadcast ping for that subnet is ping 172.16.1.255... regarding snmp, I said it's painful :-)... are you sure you polled with snmpbulkwalk -v 2c -m BRIDGE-MIB -c <snmp-community>@<vlan> <host-address> dot1dTpFdbAddress? In other words, if your community is "PUBLIC" and you're polling Vlan 501, poll BRIDGE-MIB with the community "PUBLIC@501"
    – Mike Pennington
    Jun 24, 2013 at 18:58
  • Note: any remotely secured device will not answer a broadcast ping.
    – Ricky
    Jun 24, 2013 at 19:06
  • @RickyBeam, that's why I said he needs to do it from the switch with the connected SVI... I also realize that Windows doesn't answer pings by default... so this is better than nothing, but admittedly not a 100% solution... we're dealing with some suboptimal constraints in this problem
    – Mike Pennington
    Jun 24, 2013 at 19:14
  • 1
    @AJJ. The mac-address table has a five-minute cache time by default, were those devices disconnected less than five minutes? If you need real-time info, you'll need to check ifOperStatus, which means the convoluted MIB value mapping exercise I mentioned in my answer. If these are all machines using DHCP, you might consider DHCP snooping as suggested by GeneralNetworkError below
    – Mike Pennington
    Jun 25, 2013 at 14:06
5

DHCP Snooping for both the L3 IP and L2 MAC addresses if you seek to just identify your clients using dynamic addresses. This is used for security to block rogue DHCP servers and only allow packets to be received on switchports with valid DHCP addresses that were offered and requested (i.e., actually in use).

Enable dhcp snooping globally for your VLANs you want to watch

ip dhcp snooping vlan 10,20,30,40,50
no ip dhcp snooping information option
no ip dhcp snooping verify mac-address
ip dhcp snooping

Be sure to identify your trusted interfaces that have your DHCP servers behind them using:

interface xy/z
 ip dhcp snooping trust

Sample bindings table of IP-MAC addresses:

s-oc2-3h-s1#sh ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
B4:B5:2F:DB:85:C6   172.17.3.29      254427      dhcp-snooping   30    FastEthernet1/0/30
3C:07:54:3F:91:CB   172.17.3.26      224542      dhcp-snooping   30    FastEthernet2/0/42
6C:62:6D:77:95:1A   172.17.3.37      256986      dhcp-snooping   30    FastEthernet1/0/17
B4:B5:2F:2D:27:37   172.17.3.22      149352      dhcp-snooping   30    FastEthernet2/0/30
B4:B5:2F:DB:85:C2   172.17.3.18      207629      dhcp-snooping   30    FastEthernet1/0/16
...

See the ciscoDhcpSnoopingMIB for SNMP access to these objects. OID 1.3.6.1.4.1.9.9.380

Improve this answer
0
2

If IPs are dynamic, then you should have dhcp logs to get mac-ip pairs. then with SNMP you can try to understand what kind of devices you have. but keep in mind, that you have to have snmp configured and allowed from your station. If you are talking about windows machines, then it is easier to use powershell to grab information about workstations. You can also try to use nmap to scan the whole subnet and to get more information about its inhabitants.

Improve this answer
2
  • How can I fetch the DHCP logs?
    – AJ J.
    Jun 24, 2013 at 20:41
  • it depends on your dhcp server vendor...
    – Romans Fomicevs
    Jun 25, 2013 at 6:10
1

This will probably bust your requirements concerning bandwidth, but you could use a snmp discovery sw like "the dude". You would need to set community and private vlans appropriately in order for the snmp traffic to get back to the server. If you are interested in this solution I could give you more details as to vlans and sw setting required.

Improve this answer
1
  • I think "the dude" just fixed some typos in your post :-)... This happens to me a lot when I post from my HTC... were you using a cell phone?
    – Mike Pennington
    Jun 28, 2013 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.