MAC address discovery and Cisco Phones

Not sure if i’m being stupid, or it’s something else going on here.

I’ve got quite a few Cisco 3850 switch stacks, and they all have Cisco phones attached to them. Many of those phones then have client PCs plugged into them. The MAC address tables in LibreNMS only show the phones MAC addresses on each port, not the PCs as well. I know the switches do contain this data, so I’m curious if this is working 100%, or this is expected behaviour?

Post the output of ./discovery.php -h HOSTNAME -m cisco-mac-accounting -d

Does that even show both the MAC addresses in that output?

Hi,

Running the command doesn’t output much data (sanitised output).

$ sudo -u librenms ./discovery.php -h X.X.X.X -m cisco-mac-accounting -d
LibreNMS Discovery
===================================
Version info:
Commit SHA: 0cf8c2615fbbc90577eec9402998c12724a84955
Commit Date: 1509392641
DB Schema: 213
PHP: 5.4.16
MySQL: 5.5.56-MariaDB
RRDTool: 1.4.8
SNMP: NET-SNMP 5.7.2
==================================DEBUG!
SQL[SELECT * FROM `devices` WHERE status = 1 AND disabled = 0 AND `hostname` LIKE 'X.X.X.X' ORDER BY device_id DESC]
SQL[SELECT * FROM devices_attribs WHERE `device_id` = '39']
X.X.X.X 39 iosxe SQL[INSERT INTO `device_perf` (`xmt`,`rcv`,`loss`,`min`,`max`,`avg`,`device_id`,`timestamp`)  VALUES ('3','3','0','3.06','3.34','3.17','39',NOW())]
SNMP Check response code: 0
SQL[SELECT attrib_value FROM devices_attribs WHERE `device_id` = '39' AND `attrib_type` = 'poll_mib' ]

Modules status: Global+ OS+ Device
#### Load disco module cisco-mac-accounting ####
sh: -M: command not found
SQL[SELECT * FROM `ports` WHERE `device_id` = '39' AND `ifIndex` = '']


>> Runtime for discovery module 'cisco-mac-accounting': 0.0030 seconds with 5088 bytes
#### Unload disco module cisco-mac-accounting ####

SQL[SELECT attrib_value FROM devices_attribs WHERE `device_id` = '39' AND `attrib_type` = 'poll_mib' ]
SQL[UPDATE `devices` set `last_discovered` =NOW(),`last_discovered_timetaken` ='1.892' WHERE `device_id` = '39']
Discovered in 1.892 seconds

SQL[INSERT INTO `perf_times` (`type`,`doing`,`start`,`duration`,`devices`,`poller`)  VALUES ('discover','X.X.X.X','1509462650.2705','1.928','1','librenms.server.name')]
./discovery.php X.X.X.X 2017-10-31 15:10:52 - 1 devices discovered in 1.928 secs
SNMP: Get[1/1.48s] Walk [0/0.00s]
MySQL: Cell[2/0.00s] Row[3/0.00s] Rows[4/0.00s] Column[0/0.00s] Update[1/0.00s] Insert[2/0.00s] Delete[0/0.00s]

By the way, I only removed the hostname and IP.

Ok so that module doesn’t look like it’s been working.

Can you edit includes/discovery/cisco-mac-accounting.inc.php and replace line 4 with:

$datas = snmp_walk($device, 'cipMacSwitchedBytes', '-Oqn', 'CISCO-IP-STAT-MIB');

re-run discovery.

Hi,

I modified the file, re-ran discovery:

 php discovery.php -d -m cisco-mac-accounting -h x.x.x.x
LibreNMS Discovery
===================================
Version info:
Commit SHA: ad739252a292713b8f932df13cab6247ef19c532
Commit Date: 1510006296
DB Schema: 215
PHP: 5.4.16
MySQL: 5.5.56-MariaDB
RRDTool: 1.4.8
SNMP: NET-SNMP 5.7.2
==================================DEBUG!
SQL[SELECT * FROM `devices` WHERE status = 1 AND disabled = 0 AND `hostname` LIKE 'x.x.x.x' ORDER BY device_id DESC]
SQL[SELECT * FROM devices_attribs WHERE `device_id` = '39']
x.x.x.x 39 iosxe SQL[INSERT INTO `device_perf` (`xmt`,`rcv`,`loss`,`min`,`max`,`avg`,`device_id`,`timestamp`)  VALUES ('3','3','0','3.06','3.33','3.22','39',NOW())]
SNMP Check response code: 0
SQL[SELECT attrib_value FROM devices_attribs WHERE `device_id` = '39' AND `attrib_type` = 'poll_mib' ]

Modules status: Global+ OS+ Device
#### Load disco module cisco-mac-accounting ####
SNMP[/usr/bin/snmpbulkwalk -v3 -n '' -l 'authPriv' -a 'SHA' -A 'SEKRITS!' -u 'MySNMPThing' -x 'AES' -X 'SEKRITS!' -Oqn -m CISCO-IP-STAT-MIB -M /var/librenms/librenms/mibs:/var/librenms/librenms/mibs/cisco udp:HOSTNAME:161 cipMacSwitchedBytes]
.*.*.*.1.4 No Such Instance currently exists at this OID

SQL[SELECT * FROM `ports` WHERE `device_id` = '39' AND `ifIndex` = '']


>> Runtime for discovery module 'cisco-mac-accounting': 0.0670 seconds with 5320 bytes
#### Unload disco module cisco-mac-accounting ####

SQL[SELECT attrib_value FROM devices_attribs WHERE `device_id` = '39' AND `attrib_type` = 'poll_mib' ]
SQL[UPDATE `devices` set `last_discovered` =NOW(),`last_discovered_timetaken` ='0.542' WHERE `device_id` = '39']
Discovered in 0.542 seconds

SQL[INSERT INTO `perf_times` (`type`,`doing`,`start`,`duration`,`devices`,`poller`)  VALUES ('discover','x.x.x.x','1510046844.0199','0.596','1','my.librenms.server')]
discovery.php x.x.x.x 2017-11-07 09:27:24 - 1 devices discovered in 0.596 secs
SNMP: Get[1/0.06s] Walk [1/0.07s]
MySQL: Cell[2/0.00s] Row[3/0.00s] Rows[4/0.00s] Column[0/0.00s] Update[1/0.00s] Insert[2/0.00s] Delete[0/0.00s]

I can see snmpulkwalk is now running, but failing. The mib path is correct, it’s a consequence of the server running out of space. The path exists, and the MIBs are present. Running the command directly produces the result:

.1.3.6.1.4.1.9.9.84.1.2.1.1.4 No Such Instance currently exists at this OID

More than happy to help debug this, so throw stuff my way and I’ll dig into it. :slight_smile:

I get the same on my device as well. Wonder if anyone has working data from this.

I have a feeling that the OID you’re looking for is relevant to routers:

Whereas Catalyst does it differently:

Or at least, that’s what it seems. I shall try it and see what happens.

Well I can get a list of VLANs and MACs from the switch using the method in the second link.

Had to add this bit of config:
snmp-server group SNMP-GROUP-PRIV v3 auth context vlan- match prefix

I can return a list of VLAN IDs:
snmpwalk -v3 -n ‘’ -l ‘authPriv’ -a ‘SHA’ -A ‘’ -u ‘’ -x ‘AES’ -X ‘’ udp::161 .1.3.6.1.4.1.9.9.46.1.3.1.1.2

And then specify the context with snmpwalk (vlan-), and it returns MAC addresses.

snmpwalk -v3 -On -n vlan-<VLANID> -l 'authPriv' -a 'SHA' -A '<PASSPHRASE>' -u '<USERNAME>' -x 'AES' -X '<PASSPHRASE>' udp:<HOSTNAME>:161 1.3.6.1.2.1.17.4.3.1.1