Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to get a text file listing which IP addresses are on my local subnet and which ethernet switch they connect to. Ideally the name of the machine would be nice but I can work that out manually.

Someone has suggested NMAP. I have tried it and am overwhelmed by the number of options. Is there an option that would give me this sort of info.

My gut feeling is that it is harder to find out switch information because swithces are transparent to IP. Can someonce suggest a way.

share|improve this question
This depends on the type of Ethernet Switch. If the switch is dumb then I think you are out of luck. – dbasnett Jul 24 '10 at 17:16
up vote 3 down vote accepted

use for instance

nmap -sP -PR

(Use the appropriate network address and mask)

To map the hosts. -sP skips the portscan, while -PR requests an ARP scan, which only works on local networks, but cannot be blocked by firewalls (actually, it can, but it is insanely impractical).

You can filter that out to a sample list with some scripting:

nmap -sP -PR 2>/dev/null |grep "appears to be up" |awk '{print $2}'

To get the physical location, you need a manageable switch. Good manageable switches will answer to SNMP and let you query the location of a specific MAC address.

You first need to map IP to MAC adresses, you can try to process the output of nmap, but it is easier to consult the system ARP table (read /proc/arp on *nix, or try the arp command).

Once you have a MAC address, the standard way of getting the port via SNMP will generally be trough the Q-BRIDGE-MIB if your switch handles VLANs, or (IIR) the P-BRIDGE-MIB. You can query it, for instance with the net-snmp tools:

snmpget -v2c -c public Q-BRIDGE-MIB::dot1qTpFdbPort.y.x.x.x.x.x.x

Where public is the name of the SNMP community, is the address of the switch, y is the VLAN id and the x are the decimal-coded bytes of the MAC address. You will probably need to enable SNMP on the switch, allow access from your station, use a different community name and/or protocol version.

For switches not handling VLANs, there are equivalent entries in the P-BRIDGE-MIB iirc.

To see how the address coding works, you can use snmpwalk to retreive the complete forwarding table of the switch, like this:

smpwalk -v2c -c public Q-BRIDGE-MIB::dot1qTpFdbPort

If you have several switches, each MAC will show up at the correct port on the correct switch, but also on the relevant trunk ports of the other switches, so you will need a way to filter out trunk ports.

share|improve this answer

List all the hosts using your gateway (probably a switch (or router)

arp-scan -I eth0 -l

share|improve this answer

Well not sure which OS you are using but to some extent you can find the info from your machine. You should run the wireshark (ethereal) tool. This will should you over all packets travelling between network. You wont get the listing of all machines but will be able to see many networks and machines. After this you can check your arp table and also find the machines IP, mac address. Your subnet mask should tell you how many machines are allowed in the current network.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .