Start a Conversation

Unsolved

This post is more than 5 years old

J

28430

November 6th, 2006 13:00

OID To retrieve dynamic address database?

I was going to right a script to snmpwalk our 3348 and 3448 switches dynamic address databases for when we have a rogue MAC address on our LAN in order to find out where it is.

Does someone know the OID for this on those switches, or if that's even what I need to accomplish this?

Thanks for the help.

Message Edited by JPLaflamme on 11-06-2006 09:34 AM

128 Posts

November 6th, 2006 14:00

OID 1.3.6.1.2.1.17.7.1.2 (dot1qTpFdbPort)

This will give you the "show bridge address-table".

Here's an example of something you might see:

OID Value
dot1qTpFdbPort.391.0.15.31.33.109.17 2


Take the OID after 391 and that's the MAC address...it just needs to be converted.

The value is the port the MAC address is on.

Message Edited by Mithrilhall on 11-06-2006 10:35 AM

Message Edited by Mithrilhall on 11-06-2006 10:36 AM

128 Posts

November 6th, 2006 14:00

I believe this is it....



.1.3.6.1.2.1.17.7.1.2.2.1.2

16 Posts

November 6th, 2006 14:00

Hmmm, well that certainly does show the MAC addresses eventually. It also shows all kinds of other info.

The dynamic addresses seem to start at .1.3.6.1.2.1.17.4.3.1.1.0.

How do I find the port associated with the MAC address?

16 Posts

November 6th, 2006 15:00

Interesting. Thank you.
I found that using snmpwalk in Linux on the OID .1.3.6.1.2.1.17.4.3.1.1 returns all the MACS in the database (in hex) but no ports.

Message Edited by JPLaflamme on 11-06-2006 11:13 AM

128 Posts

November 6th, 2006 15:00

Let me try it from my linux laptop and see what I get.

16 Posts

November 6th, 2006 15:00

I get inconsistent results on a 3448 using 1.3.6.1.2.1.17.7.1.2. Mostly timeouts for some reason. After trying and failing on 1.3.6.1.2.1.17.7.1.2 it also causes timeouts on .1.3.6.1.2.1.17.4.3.1.1. Weird. I plan on updating the firmware. Maybe that will fix something.

I guess when I see "INTEGER: 3" that means port 1/G1?

Seems to work much better/faster on the 3348 than the 3448

Message Edited by JPLaflamme on 11-06-2006 11:56 AM

128 Posts

November 6th, 2006 15:00

Doh!

I thought you had posted 3348. Let me check what I have for 3448.

16 Posts

November 6th, 2006 15:00

Hmmm, I'm not sure that .1.3.6.1.2.1.17.7.1.2 is showing me the right stuff on a powerconnect 3448

16 Posts

November 6th, 2006 15:00

Sorry, I have both and will be needing to do this for both.

128 Posts

November 6th, 2006 15:00

Works for me on both 33XX, 34XX and 6024X switches.

128 Posts

November 6th, 2006 16:00

Integer 49 would be 1/G1.

I also see vlans in the data.

Message Edited by Mithrilhall on 11-06-2006 12:01 PM

128 Posts

November 6th, 2006 16:00

It looks like the information returned from a walk on a 33XX & a 34XX are different so just keep that in mind when writing your script.

I wrote some custom pages to turn ports on/off via snmp. Now I'm working on saving the running configuration to the startup configuration.

16 Posts

November 6th, 2006 16:00

I must have typed in the wrong MAC (thought I was looking at an integer 3 MAC). :)

16 Posts

November 6th, 2006 16:00

Ya, I converted some of the oid integers to hex for testing on the 3448 to see what port INTEGER:51 is and it returned nothing. I see a lot of "INTEGER: 3" and "INTEGER: 51" and "INTEGER: 52" on the 3448 but not really any of the ports I would expect to see.

And actually, I just queried a MAC that said it was "INTEGER: 3" (So that should mean port 3) but when I search it in the web interface on the 3348 it's port G1.

Definitely 1.3.6.1.2.1.17.7.1.2 is causing a problem on my 3448's. When I query it with snmpwalk it just keeps timing out and then I can't even get in the web interface but the traffic is still flowing.

Curious, what version 3448's are you using?

Message Edited by JPLaflamme on 11-06-2006 12:59 PM

No Events found!

Top