Mac address recovery

snmp to your networking grear, ask for the mac-addr-table, correlate with port used.

Why on earth do you need mac-address table for ? It won't be stable for many minutes ...

In article , SnaZZZ wrote: :I have a need to interrogate 24,000 networked devices in an organisation. :The only piece of info I require from the device is its Mac address. :Now I know a Fluke Device which is rather expensive is able to do this, but :I would like to know if there is any other way.

It's pretty much impossible to do reliably.

:1. Not all devices have an IP address they are on DHCP, so a ping command :will not work. Once cable is removed no IP is assigned thus no Mac address.

ARP tables time out after 3 minutes usually, so missing device while it is talking is a very real possibility if you try to proceed by way of SNMP probes of the routers and switches.

:2. Its needs to be an inexpensive way to get the Mac address either using a :laptop with crossover or a PDA type device with the right adaptor :3.The recovery of the Mac address will be done by semi-skilled staff (uni :students with little or no technical skill), so it needs to be easy

Ummm, I just realized that your wording leaves open the possibility that you are planning to have staff go around to each of the devices and use the gizmo to probe the MAC address. Is that correct? Or are you trying to do this in an automated way from a management program?

If the idea is to go around to each device, then you have to be aware that there is no way to provoke a device that is certain to make it respond. Devices can do whatever they want when they receive packets, including ignoring the packets.

The Fluke LanMeter and later decendants do not reliably discover MAC addresses: they more or less just wait for the host to say something.

Any given PC or Unix machine might be firewalled to not respond to probes. Some systems will, though, ARP for their own IP address as they come up (or as the interface is brought up), so as to detect whether another machine is already using that IP address. You can thus usually get a machine to say

-something- by rebooting it.

That is correct I will be getting people to walk the floors and visit the device individually. Most of the devices in question are Multifunction devices , ie photocopier that is a fax and printer as well Need a Mac address so that a third party billing audit application database can be populated. Snmp will them be used once the connection has been made. Bi-directional information things like meter readings and consumable status etc.

SnaZZZ

I'm not sure that's going to work like you think, but most MF devices will give you their MAC address on their test page printout.

If the "third party billing audit application database" knows about MAC addresses, why can't it be the one to find them?

organisation.

You are making a big assumption if you think a device will only have 1 MAC.

for an extreme case, a big Cisco switch or router may be allocated 1024 - and although they may correlate to the port you may get different answers if you ask in different ways.

In general, anything with more than 1 ethernet port may have more than 1 "native" mac address.

more seriously, MAC address get mutated in some circumstances - a cisco router using VRRP or HSRP to give a resilient default gateway has a native MAC and 1 or more assigned MACs. Last time i checked the hardware ran out of table space at 16 or 256 MACs on an individual port......

Running DECnet or OSI on a device will make it change its operational MAC address to suit the protocol.

even a printer with say an appletalk or wireless lan and ethernet ports may have 2 mac addresses

ping will still work even if you have a fixed IP on the device.

But - if you ping across a device across something like a firewall or a router running proxy ARP, then the intervening device will answer with its own MAC address

So - what do you use the database for once you have it - are you going to repeat the scan periodically?

After all, if you dont verify, some clever student with a random number generator and a bit of programming is going to save himeself a lot of effort....

And what happens when you upgrade a server from 10/100 to 1000, or the LAN card fails and gets swapped out?

Some devices never generate a response to ARP (or any other packet)- a sniffer or IDS probe springs to mind. But, since the standard says they must have a MAC, it is there, it just wont tell you what it is.

Seems like a very expensive way of billing ( and easy to cirumvent too) I guess it's "managements descition" ??