[c-nsp] Getting ARP table from SNMP

[Laurent Geyer]

On 10/16/06, Drew Weaver <drew.weaver at thenap.com> wrote:
>
>     Hi there, I read the archives and I found a similarly titled post
> from some time ago, I am wondering if since that time any improvements
> or additions have been added that may help me.
>
> Basically I am looking for the functionality in which I can supply an IP
> address to my switch via SNMP and it will return the mac address which
> it is sending ARP requests for that IP address.. so far this is what I
> have:
>
> [root at nessie ~]# snmpget -v2c -c community switch
> .iso.org.dod.internet.mgmt.mib2.at.atTable.atEntry.atPhysAddress.376.1.1
> 92.168.0.1
>
>
> RFC1213-MIB::atPhysAddress.376.1.192.168.0.1 = Hex-STRING: 00 90 7F 32
> 90 92
>
> the problem I have with the above is simply that I do not know the port
> id (376) beforehand, so is there anyway to simply send the IP address?


A bit messy maybe, but you could just do a snmp bulk walk on atPhysAddress (
1.3.6.1.2.1.3.1.1.2) and grep for the IP address.

Something like this should work:

`snmpbulkwalk -v2c -c <community string> <switch/router>
1.3.6.1.2.1.3.1.1.2| grep <IP address>'

Personally, I've written a perl script that  walks the ARP table  every now
and again and stores the  information I'm after in a database.  This way I'm
able to observe changes, and maintain a historical view of my ARP tables
with a simple DBI based Perl script.

I'm not much of a programmer but  if you're interested  I can clean my code
up a bit and send you what I've got.

-  Laurent