Hej alle,
On Sat, 18 Apr 2009 12:49:54 +0200
Michael Rasmussen <mir@miras.org> wrote:
> Jeg skal gerne indrømme, at jeg ikke er nogen netværksteknikker, men er
> programmør, så beskrivelserne på meget gerne være rettet mod brugen af
> OID og SNMP i forbindelse med skrivning af programmer/scripts for
> netværksovervågning.
>
Jeg har nu fået konstrueret nedenstående Perl script, der kan udskrive
samtlige konfigurerede vlans samt de kendte MAC for et fundet vlan, ved
at kalde et vilkårlig switch gennem dens management interface:
#! /usr/bin/env perl
use SNMP;
#use Data::Dumper;
use strict;
use warnings;
#use diagnostics;
my ($session, $vars, $vlan, @vlans, $vtype, $portname, $portnum,
$macaddr, $ifnum, %ifnum, %portname, $ip);
# These are the extra MIB module files we need, found in the same
# directory as this script
SNMP::addMibFiles(
'BRIDGE-MIB.my',
'SNMPv2-TC-v1.my',
'CISCO-SMI.my',
'CISCO-TC.my',
'CISCO-VTP-MIB-V1SMI.my');
# Connect and get the list of VLANs on this switch
$session = new SNMP::Session(DestHost => $ARGV[0],
Community => $ARGV[1],
Version => 1);
die "session creation error: $SNMP::Session::ErrorStr" unless
(defined $session);
# ifIndex: 1.3.6.1.2.1.2.2.1.1
# ifType: 1.3.6.1.2.1.2.2.1.3
# in IF-MIB
$vars = new SNMP::VarList(['vtpVlanState']);
$session->getnext($vars);
die $session->{ErrorStr} if ($session->{ErrorStr});
# Only continue if no errors are detected and
# as long as a we are dealing with a vtpVlanState
while (!$session->{ErrorStr} && $$vars[0]->tag eq "vtpVlanState"){
$$vars[0]->iid =~ /\.(\d+)/;
# VLANS 1000 and over are not "real" ON A CISCO CATALYST 2XXX - 5XXX
# (this limit is likely to be different on different switches)
push(@vlans,$1) if $1 < 1000;
$session->getnext($vars);
};
# for each VLAN, query for the bridge port, the interface number
# associated with that port, and then the interface name for that
# port number
foreach $vlan (@vlans){
print "Probing VLAN $vlan\n";
print "-------------------------------------\n";
# note our use of "community string indexing" as part
# of the session setup
$session = new SNMP::Session(DestHost => $ARGV[0],
Community => $ARGV[1]."@".$vlan,
UseSprintValue => 1,
Version => 1);
die "session creation error: $SNMP::Session::ErrorStr"
unless (defined $session);
# from transparent forwarding port table at
# dot1dBridge.dot1dTp.dot1dTpFdbTable.dot1dTpFdbEntry
# in RFC1493 BRIDGE-MIB
$vars = new SNMP::VarList(
['dot1dTpFdbAddress'],
['dot1dTpFdbPort']);
($macaddr,$portnum) = $session->getnext($vars);
die $session->{ErrorStr} if ($session->{ErrorStr});
while (!$session->{ErrorStr} and
$$vars[0]->tag eq "dot1dTpFdbAddress"){
# dot1dBridge.dot1dBase.dot1dBasePortTable.dot1dBasePortEntry
# in RFC1493 BRIDGE-MIB
$ifnum =
(exists $ifnum{$portnum}) ? $ifnum{$portnum} :
($ifnum{$portnum} =
$session->get("dot1dBasePortIfIndex\.$portnum"));
# from ifMIB.ifMIBObjects.ifXTable.ifXEntry in RFC1573 IF-MIB
$portname =
(exists $portname{$ifnum}) ? $portname{$ifnum} :
($portname{$ifnum}=$session->get("ifName\.$ifnum"));
# Example output from a single Cisco 2940 Catalyst switch
#Probing VLAN 1
#-------------------------------------
#"00 21 91 F4 6B D5 " on VLAN 1 at Fa0/8
#"00 40 63 D6 2C 63 " on VLAN 1 at Fa0/8
#"00 80 77 C6 39 67 " on VLAN 1 at Fa0/8
#"00 E0 4C 81 05 1C " on VLAN 1 at Fa0/8
#-------------------------------------
#Probing VLAN 20
#-------------------------------------
#"00 48 54 74 B2 D4 " on VLAN 20 at Fa0/3
#"CC 00 00 7D F8 77 " on VLAN 20 at Fa0/3
#-------------------------------------
# Filter out noise
if ($macaddr =~ /[0-9,A-F,a-f,\s]{6}/) {
print "$macaddr on VLAN $vlan at $portname\n";
}
($macaddr,$portnum) = $session->getnext($vars);
};
print "-------------------------------------\n";
}
Det jeg mangler er følgende:
- Find next hop for hvert vlan
En mulig algoritme:
Oversæt de fundne MAC til IP -
1) MAC uden IP må være Switchens port
2) Eksisterer kun en IP for en given port, må denne være next hop
3) Findes flere IP for en given port, kan next hop findes på følgende
måde:
a) Ping alle fundne IP for en given port fra en host udenfor
netsegment
b) Når en MAC fremtræder med to forskellige IP, har vi next hop
Så mit spørgsmål er, om man via SNMP og en Cisco Catalyst kan få
oversat MAC til IP på andre vlan end management vlan?
--
Hilsen/Regards
Michael Rasmussen
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
A computer is like air conditioning: it becomes useless when you open
windows.