Need help to understand whats transmited over SNMP when i use the ipNetToPhysicalEntry OID

Question

I need a little bit of help to understand what Information the ipNetToPhysicalEntry OID 1.3.6.1.2.1.4.35.1 exactly includes. I thought its a combination between the Neighbor Cache and the ARP Cache, but when i read this OID over, lets say snmpwalk, i don´t get everything whats inside my Routers Neighbor Cache and ARP Cache. What are the criteria which information is inside and which not? And where can I see the definition for that ?

Answer 1

In addition to Ricky's answer, you can also use the snmptranslate utility to dump information about SNMP tables and how table entries are indexed, etc. The -Tp -IR flags will tell snmptranslate to print a tree view of the table. A very useful (and overlooked) utility IMO.

Here's the output for ipNetToPhysicalTable (which is the table object to which ipNetToPhysicalEntry belongs):

jjensen@VA1-NETOPS-DEV-01:~/.snmp$ snmptranslate -M +mibs -m +ALL -Tp -IR ipNetToPhysicalTable
+--ipNetToPhysicalTable(35)
   |
   +--ipNetToPhysicalEntry(1)
      |  Index: ipNetToPhysicalIfIndex, ipNetToPhysicalNetAddressType, ipNetToPhysicalNetAddress
      |
      +-- ---- Integer32 ipNetToPhysicalIfIndex(1)
      |        Textual Convention: InterfaceIndex
      |        Range: 1..2147483647
      +-- ---- EnumVal   ipNetToPhysicalNetAddressType(2)
      |        Textual Convention: InetAddressType
      |        Values: unknown(0), ipv4(1), ipv6(2), ipv4z(3), ipv6z(4), dns(16)
      +-- ---- String    ipNetToPhysicalNetAddress(3)
      |        Textual Convention: InetAddress
      |        Size: 0..255
      +-- CR-- String    ipNetToPhysicalPhysAddress(4)
      |        Textual Convention: PhysAddress
      |        Size: 0..65535
      +-- -R-- TimeTicks ipNetToPhysicalLastUpdated(5)
      |        Textual Convention: TimeStamp
      +-- CR-- EnumVal   ipNetToPhysicalType(6)
      |        Values: other(1), invalid(2), dynamic(3), static(4), local(5)
      +-- -R-- EnumVal   ipNetToPhysicalState(7)
      |        Values: reachable(1), stale(2), delay(3), probe(4), invalid(5), unknown(6), incomplete(7)
      +-- CR-- EnumVal   ipNetToPhysicalRowStatus(8)
               Textual Convention: RowStatus
               Values: active(1), notInService(2), notReady(3), createAndGo(4), createAndWait(5), destroy(6)

Now you can see how an entry in the table is supposed to be indexed, and also the OIDs that make up the table. The first 3 entries are the indexes. Each entry in the table is going to have these 3 indexes - essentially ipNetToPhysicalIfIndex + ipNetToPhysicalNetAddressType + ipNetToPhysicalNetAddress. Then subsequently there are 5 "columns" in a row of this table:

1. ipNetToPhysicalPhysAddress
2. ipNetToPhysicalLastUpdated
3. ipNetToPhysicalType
4. ipNetToPhysicalState
5. ipNetToPhysicalRowStatus

Here's an example from one of my devices:

IP-MIB::ipNetToPhysicalPhysAddress.1.ipv4."10.200.17.34" = STRING: 74:8e:f8:62:59:41

So think of this like a row entry in the table, and we've picked out column 1 from the row, which is ipNetToPhysicalPhysAddress. So in this particular entry, the .1.ipv4."10.200.17.34" part is the index of the entry. The 1 is the ifIndex of the interface that the ARP entry is learned on, 'ipv4' is the ipNetToPhysicalNetAddressType which is one of these: unknown(0), ipv4(1), ipv6(2), ipv4z(3), ipv6z(4), dns(16) and finally, the IP address of the ARP entry, 10.200.17.34. These three things make up the index for that entry. Then the value for ipNetToPhysicalPhysAddress at that specific index is the MAC address 748e.f862.5941.

but when i read this OID over, lets say snmpwalk, i don´t get everything whats inside my Routers Neighbor Cache and ARP Cache.

This could very well be an issue with the SNMP implementation of your device (which you've given us zero information about by the way). It would be useful if you could edit your original question to include this information, as well as output from snmpbulkwalk against the ipNetToPhysicalTable table. Also, you could try doing an snmpbulkwalk against ipv6NetToMediaTable to see if you get results from that.

Answer 2

The IP Address Translation table used for mapping from IP addresses to physical addresses.

The Address Translation tables contain the IP address to 'physical' address equivalences. Some interfaces do not use translation tables for determining address equivalences (e.g., DDN-X.25 has an algorithmic method); if all interfaces are of this type, then the Address Translation table is empty, i.e., has zero entries.

While many protocols may be used to populate this table, ARP and Neighbor Discovery are the most likely options.

(Cisco IP-MIB-V1SMI.my)

(testing with c1811 @ 15.1.4-M7)

snmpwalk (or snmpbulkwalk) shows 20 elements. And that's exactly correct: 19 IPv4 and 1 IPv6. snmptable, however, fails to populate correctly unless it's told to use bulk requests.

rtr1811#show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.xx.xx.1              -   0023.5ee6.1d38  ARPA   Vlan1
Internet  10.xx.xx.201          205   001b.243e.1226  ARPA   Vlan1
Internet  10.xx.xx.202            0   001b.245d.686a  ARPA   Vlan1
Internet  10.xx.xx.252           65   0009.3d10.c3c7  ARPA   Vlan1
Internet  72.xxx.xxx.1            0   00a0.c8a7.5f19  ARPA   FastEthernet0
Internet  72.xxx.xxx.11           -   0023.5ee6.1d38  ARPA   FastEthernet0
Internet  72.xxx.xxx.14           0   00d0.b780.a68f  ARPA   FastEthernet0
Internet  192.168.xx.1           12   0004.23c6.a4ec  ARPA   FastEthernet1
Internet  192.168.xx.5           69   001c.581d.0d1b  ARPA   FastEthernet1
Internet  192.168.xx.8            -   0023.5ee6.1d39  ARPA   FastEthernet1
Internet  192.168.xx.9           40   0013.807a.7773  ARPA   FastEthernet1
Internet  192.168.xx.25          10   0009.3d10.c3c6  ARPA   FastEthernet1
Internet  192.168.xx.42           8   0021.2875.9eb6  ARPA   FastEthernet1
Internet  192.168.xx.100          1   0014.2232.d375  ARPA   FastEthernet1
Internet  192.168.xx.103          0   4061.860d.aa18  ARPA   FastEthernet1
Internet  192.168.xx.113          0   4061.860d.aa2e  ARPA   FastEthernet1
Internet  192.168.xx.171          0   0009.3d12.d8a1  ARPA   FastEthernet1
Internet  192.168.xx.172          0   0009.3d12.e10a  ARPA   FastEthernet1
Internet  192.168.xx.249         10   d07e.28d1.4201  ARPA   FastEthernet1
rtr1811#show ipv6 neighbors 
IPv6 Address                              Age Link-layer Addr State Interface
...:021B:24FF:FE3E:1226           0 001b.243e.1226  REACH Vl1

[bulk request]

[root:pts/5{4}]spork:~/[05:52 PM]:snmptable -CB -v 2c -c [] -m ALL 192.168.xx.8 ipNetToPhysicalTable
SNMP table: IP-MIB::ipNetToPhysicalTable

 ipNetToPhysicalPhysAddress ipNetToPhysicalLastUpdated ipNetToPhysicalType ipNetToPhysicalState ipNetToPhysicalRowStatus
       "00 A0 C8 A7 5F 19 "               0:0:00:45.10             dynamic              unknown                   active
       "00 23 5E E6 1D 38 "               0:0:00:45.10              static              unknown                   active
       "00 D0 B7 80 A6 8F "               0:0:00:45.10             dynamic              unknown                   active
       "00 04 23 C6 A4 EC "               0:0:00:45.14             dynamic              unknown                   active
       "00 1C 58 1D 0D 1B "               0:0:00:45.14             dynamic              unknown                   active
       "00 23 5E E6 1D 39 "               0:0:00:45.14              static              unknown                   active
       "00 13 80 7A 77 73 "               0:0:00:45.14             dynamic              unknown                   active
       "00 09 3D 10 C3 C6 "               0:0:00:45.14             dynamic              unknown                   active
       "00 21 28 75 9E B6 "               0:0:00:45.14             dynamic              unknown                   active
       "00 14 22 32 D3 75 "               0:0:00:45.14             dynamic              unknown                   active
       "40 61 86 0D AA 18 "               0:0:00:45.14             dynamic              unknown                   active
       "40 61 86 0D AA 2E "               0:0:00:45.14             dynamic              unknown                   active
       "00 09 3D 12 D8 A1 "               0:0:00:45.14             dynamic              unknown                   active
       "00 09 3D 12 E1 0A "               0:0:00:45.14             dynamic              unknown                   active
       "D0 7E 28 D1 42 01 "               0:0:00:45.14             dynamic              unknown                   active
       "00 23 5E E6 1D 38 "               0:0:00:45.22              static              unknown                   active
       "00 1B 24 3E 12 26 "               0:0:00:45.22             dynamic              unknown                   active
       "00 1B 24 5D 68 6A "               0:0:00:45.22             dynamic              unknown                   active
       "00 09 3D 10 C3 C7 "               0:0:00:45.22             dynamic              unknown                   active
       "00 1B 24 3E 12 26 "             45:17:36:28.75             dynamic                stale                   active

[non-bulk]

[root:pts/5{4}]spork:~/[05:53 PM]:snmptable -v 2c -c [] -m ALL 192.168.xx.8 ipNetToPhysicalTable
SNMP table: IP-MIB::ipNetToPhysicalTable

 ipNetToPhysicalPhysAddress ipNetToPhysicalLastUpdated ipNetToPhysicalType ipNetToPhysicalState ipNetToPhysicalRowStatus
       "00 D0 B7 80 A6 8F "               0:0:00:45.10             dynamic              unknown                   active
       "D0 7E 28 D1 42 01 "               0:0:00:45.14             dynamic              unknown                   active
       "00 21 28 75 9E B6 "               0:0:00:45.14             dynamic              unknown                   active
       "00 14 22 32 D3 75 "               0:0:00:45.14             dynamic              unknown                   active
       "40 61 86 0D AA 18 "               0:0:00:45.14             dynamic              unknown                   active
       "40 61 86 0D AA 2E "               0:0:00:45.14             dynamic              unknown                   active
       "00 09 3D 10 C3 C7 "               0:0:00:45.22             dynamic              unknown                   active
       "00 1B 24 3E 12 26 "             45:17:41:29.78             dynamic                stale                   active