12

I am asking this question which is related to a question I previously asked and was comprehensively answered by @MikePennington. When I asked that question, I intended to know how to poll arp table from a switch, but in his answer, he included mac address tables as well. Out of curiousity, I polled for the mac address tables. I used the command:

 sudo /usr/bin/snmpbulkwalk -v 2c -c public@1 -OXsq 10.0.0.98 .1.3.6.1.2.1.17.4.3.1.2

In Mike`s solution, he had a clear result shown below

[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public@10 -OXsq \
    172.16.1.210 .1.3.6.1.2.1.17.4.3.1.2 
dot1dTpFdbPort[0:6:53:fe:39:e0] 52 
dot1dTpFdbPort[0:1d:a1:cd:53:46] 52 
dot1dTpFdbPort[0:30:1b:bc:a7:d7] 52
 dot1dTpFdbPort[0:80:c8:0:0:0] 52 
dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 52 
dot1dTpFdbPort[80:ee:73:2f:b:40] 52 
[mpenning@tsunami ~]$

This is a clear solution in which you can easily tell the port and Mac Address. However, my own solution comes out in the form of

iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25
iso.3.6.1.2.1.17.4.3.1.2.0.21.23.10.229.224 25
iso.3.6.1.2.1.17.4.3.1.2.28.111.101.71.85.113 25
iso.3.6.1.2.1.17.4.3.1.2.28.111.101.174.157.35 25
iso.3.6.1.2.1.17.4.3.1.2.48.133.169.153.178.62 25
iso.3.6.1.2.1.17.4.3.1.2.60.208.248.182.16.108 25
iso.3.6.1.2.1.17.4.3.1.2.108.240.73.231.208.120 25

I understand that the port number is 25, but do the other numbers represent a MAC address and if so, why are they different from the give solution?

Any Help will be truly appreciated. I am polling a Cisco Catalyst 2960 switch.

Community
  • 1
sosytee
  • 685
  • 1
  • 7
  • 12
  • 2
    You're missing MIB file which tells how to read the data. But it's just base10 presentation of your MAC, iso.3.6.1.2.1.17.4.3.1.2. **28.111.101.71.85.113** 25, easy to convert to base16. ruby -e 'p ARGV[0].split(".")[-6..-1].map{|e|e.to_i.to_s(16)}.join(":")' iso.3.6.1.2.1.17.4.3.1.2.28.111.101.71.85.113 25, yields "1c:6f:65:47:55:71" - looks to be gigabyte OUI – ytti Aug 28 '13 at 08:13
  • Can you please post the equivalent MAC addresses? It looks like you may just be dumping them in decimal instead of hex, but we'd need the hex addresses to compare. – chrylis -cautiouslyoptimistic- Aug 28 '13 at 08:17
  • the only way to get the equivalent MAC addresses would be to convert because from that solution, it is all pointing to port 25 so i believe it is a complicated procedure to try and find the corresponding MAC`s. – sosytee Aug 28 '13 at 08:27
  • @ytti should i install the MIB on my server? – sosytee Aug 28 '13 at 08:29
  • 1
    @sosytee yes you should install appropriate MIB in your server if converting it yourself is not an option, it is overly trivial as shown above. – ytti Aug 28 '13 at 08:36
  • @ytti it is now working properly, if you could make it an answer so that i can accept it – sosytee Aug 28 '13 at 09:16
  • @sosyte Answer yourself, as I didn't bother figuring out which MIB it is and where to get. So you can give much more complete answer yourself. – ytti Aug 28 '13 at 10:33

1 Answers1

8

my own solution comes out in the form of

iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25

... do the other numbers represent a MAC address and if so, why are they different from the give solution?

First, I apologize for not including this dependency...

The MIB tables you're polling are indexed by a value. In this case, you're polling dot1dTpFdbPort (which shows up as iso.3.6.1.2.1.17.4.3.1.2, if you don't have the BRIDGE-MIB loaded). That OID is indexed by a mac-address. Therefore, 0.20.42.49.139.235 is the mac-address in dotted-decimal format...

To see the results you expect, you need to get the v2 mibs from Cisco's FTP site:

  • mkdir /usr/share/snmp/mibs/cisco (as root)
  • cd /usr/share/snmp/mibs/cisco
  • Copy v2.tar.gz that you just downloaded to /usr/share/snmp/mibs/cisco/v2.tar.gz
  • tar xvfz v2.tar.gz
  • Edit /etc/snmp/snmp.conf and make this the first line in the file: mibdirs +/usr/share/snmp/mibs/cisco

Assumptions:

  • You're using NET-SNMP libraries to poll
  • Your NET-SNMP default MIBs are loaded in /usr/share/snmp/mibs/
  • Your NET-SNMP configuration is in /etc/snmp/snmp.conf
Mike Pennington
  • 29,876
  • 11
  • 78
  • 152