3

I am trying to get computer's mac address through snmp.

I have an envirmont in GNS3:

l3 R1's image is vios-adventerprisek9-m.SPA.157-3.M3

l2 SW1's image is viosl2-adventerprisek9-m.SSA.high_iron_20180619

PC1's mac address is 00:50:79:66:68:03

PC1 using vlan 10 access port through SW1, SW1 using trunk connect to vlan 10's gateway on R1, using sub interface g0/0.1, now I can get PC1's mac address on SW1 using commands:

SW1#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0ce6.df1f.ee01    DYNAMIC     Gi0/1
  10    0050.7966.6803    DYNAMIC     Gi1/0
  10    0ce6.df1f.ee01    DYNAMIC     Gi0/1
Total Mac Addresses for this criterion: 3

but I can't get it through snmp on SW1:

[root@pandorafms ~]# snmpbulkwalk -v 2c -c harvey -OXsq 192.168.55.1  .1.3.6.1.2.1.3.1.1.2
mib-2.3.1.1.2.1.1.192.168.55.1 "0C E6 DF 3A 03 00 "
mib-2.3.1.1.2.1.1.192.168.55.254 "C2 02 26 18 00 01 "
mib-2.3.1.1.2.1.1.192.168.190.128 "C2 02 26 18 00 01 "
mib-2.3.1.1.2.1.1.192.168.190.132 "C2 02 26 18 00 01 "

but I can get it through snmp on R1:

[root@pandorafms ~]# snmpbulkwalk -v 2c -c harvey -OXsq 172.16.77.1  .1.3.6.1.2.1.3.1.1.2
mib-2.3.1.1.2.1.1.172.16.77.1 "0C E6 DF 1F EE 00 "
mib-2.3.1.1.2.1.1.172.16.77.254 "C2 01 1F BC 00 10 "
mib-2.3.1.1.2.6.1.192.168.11.100 "00 50 79 66 68 03 "
mib-2.3.1.1.2.6.1.192.168.11.254 "0C E6 DF 1F EE 01 "
mib-2.3.1.1.2.7.1.192.168.22.101 "00 50 79 66 68 02 "
mib-2.3.1.1.2.7.1.192.168.22.254 "0C E6 DF 1F EE 01 "

I don't know why, I just need to get mac address on switch using snmp, in order to shutdown the port using snmp.

6

A layer-2 switch does not look at the layer-3 IP address on a packet to switch the layer-2 frames, and it only uses the MAC addresses on the frames for switching. The layer-3 interface on the switch is for switch management. It is like another host on the LAN, and it will not update its ARP table unless it communicates with a host at layer-3.

Switches use a MAC address table to switch frames. Every time a frame enters the switch, the switch will update its MAC address table with the source MAC address and interface where it was seen. The switch will then use the MAC address table to determine where the interface of destination MAC address for the frame is, and it will switch the frame to that interface. This does not have anything to do with the switch management (layer-3) ARP table.

The router will have its ARP table updated by any communications with the hosts on the network needing to send layer-3 packets to a different network, so its ARP table gets regularly updated. The switch management layer-3 interface rarely communicates with the hosts, so its ARP table does not get regularly updated with the host addresses.

Look at the switch MAC address table, instead of the ARP table, to see the MAC addresses seen on the interfaces.

| improve this answer | |
  • You are right, I have to look at mac address table, not the arp table. Do you know which OID lists mac address table? I tried to snmpbulkwalk on .1.3.6, still cannot use grep to see the host's mac address. Only the switch's mac address will show in snmp, not the host's mac address connected to switch. – user65135 Feb 15 at 9:15
  • I registered an account and it shows acces forbiddened, I don't do network job so I can't get an account from someone else either, I'm just interested. – user65135 Feb 16 at 6:10
  • You did something wrong. Anyone can get that information from Cisco. Cisco documents are freely available, all Cisco asks is that you register to be able to see them. – Ron Maupin Feb 16 at 12:30
  • I tried to register another account still got forbidden, it's a sample register page, maybe cause cisco's policy to China. So does the host's mac addresses can be get through snmp? – user65135 Feb 17 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.