Saturday, October 10, 2009

Network Switch ip to port mapping using neo

Open Source Network Administration gives some introduction to this network tool called neo. Latest version can be found ktools.org
(http://www.ktools.org/dist/neo/neo-1.3.1.tar.gz)

There is one catch while you compile & install in Ubuntu since the object_statstransfer.c , object_sleeper.c uses CLK_TCK i think CLK_TCK obsolete we have to use CLOCKS_PER_SEC instead. But i just defined as followed in the both files.

/* Define my constant */
#define CLK_TCK 100

Installation process :
1 ) gunzip -c neo-1.3.1.tar.gz | tar xvf -
2 ) cd neo-1.3.1
3 ) ./configure
4 ) Do the relevant changes as explained earlier in the both source files.
5 ) make
6 ) make install

neo has its own command line. But basic things you need to get ip to port map two command arpfind , locate .

Before doing that you can define the switches & the core router in one file. (router needed to find the ip to arp resolution)
example /var/neo/switches

192.168.1.10
192.168.1.11

if you want to find the relevant ip to arp mapping you could issue the command as
neo -c "community string" arpfind @f:/var/neo/switches
This will give u the arp address ,
then you can issue the location command to locate the port number.


neo -c "community string" locate @f:/var/neo/switches

I've combined both into one perl script. I haven't use the community string here since i complied the default community as relevant string. You can change the community string while compiling (
object_global.c


g->argv0=NULL;
g->readcom=strdup("public");
g->writecom=strdup("public");
neo_global_set_burst(g, 1);



#!/usr/bin/perl
#Arp to IP Mapper Argument as host
$arg = $ARGV[0];

#To save the actual arp
$real_arp = "";
#Identify the arp of the host
@arp = `neo arpfind $arg \@f:/root/gobi/neo-1.3.1/switches`;
foreach (@arp)
{
if ($_ =~ /says/)
{
$real_arp = substr($_,-18);
last ;
}
}
chomp($real_arp);
@port = `neo locate -u $real_arp \@f:/root/gobi/neo-1.3.1/switches`;

foreach(@port)
{
print $_;
}

root@--:~/gobi# ./run.pl 192.168.29.2
Found on 6@192.168.0.200
Found on 10@192.168.0.204

I'm doing some reverse mapping also using simple snmp queries like
@ip2arp_tbl = `snmpwalk -c "public" -v 2c 192.168.0.99 "ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaPhysAddress"`; I'll give that in a different post if successful .