1

I would like to get a text file listing which IP addresses are on my local subnet and which ethernet switch they connect to. Ideally the name of the machine would be nice but I can work that out manually.

Someone has suggested NMAP. I have tried it and am overwhelmed by the number of options. Is there an option that would give me this sort of info.

My gut feeling is that it is harder to find out switch information because swithces are transparent to IP. Can someonce suggest a way.

1
  • This depends on the type of Ethernet Switch. If the switch is dumb then I think you are out of luck.
    – dbasnett
    Jul 24, 2010 at 17:16

3 Answers 3

3

use for instance

nmap -sP -PR 192.168.1.0/24

(Use the appropriate network address and mask)

To map the hosts. -sP skips the portscan, while -PR requests an ARP scan, which only works on local networks, but cannot be blocked by firewalls (actually, it can, but it is insanely impractical).

You can filter that out to a sample list with some scripting:

nmap -sP -PR 192.168.1.0/24 2>/dev/null |grep "appears to be up" |awk '{print $2}'

To get the physical location, you need a manageable switch. Good manageable switches will answer to SNMP and let you query the location of a specific MAC address.

You first need to map IP to MAC adresses, you can try to process the output of nmap, but it is easier to consult the system ARP table (read /proc/arp on *nix, or try the arp command).

Once you have a MAC address, the standard way of getting the port via SNMP will generally be trough the Q-BRIDGE-MIB if your switch handles VLANs, or (IIR) the P-BRIDGE-MIB. You can query it, for instance with the net-snmp tools:

snmpget -v2c -c public 192.168.1.1 Q-BRIDGE-MIB::dot1qTpFdbPort.y.x.x.x.x.x.x

Where public is the name of the SNMP community, 192.168.1.1 is the address of the switch, y is the VLAN id and the x are the decimal-coded bytes of the MAC address. You will probably need to enable SNMP on the switch, allow access from your station, use a different community name and/or protocol version.

For switches not handling VLANs, there are equivalent entries in the P-BRIDGE-MIB iirc.

To see how the address coding works, you can use snmpwalk to retreive the complete forwarding table of the switch, like this:

smpwalk -v2c -c public 192.168.1.1 Q-BRIDGE-MIB::dot1qTpFdbPort

If you have several switches, each MAC will show up at the correct port on the correct switch, but also on the relevant trunk ports of the other switches, so you will need a way to filter out trunk ports.

1

List all the hosts using your gateway (probably a switch (or router)


arp-scan -I eth0 -l

0

Well not sure which OS you are using but to some extent you can find the info from your machine. You should run the wireshark (ethereal) tool. This will should you over all packets travelling between network. You wont get the listing of all machines but will be able to see many networks and machines. After this you can check your arp table and also find the machines IP, mac address. Your subnet mask should tell you how many machines are allowed in the current network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .