Finding switches with snoop
I’ve been playing with snoop to try and find out the details of network topology…
A useful tip, that I’m still working on is
snoop -x 1 -d qfe0
If you run this for a while, eventually it’ll come back with some packets that display the switch name, and port it’s connected to…
? -> (multicast) ETHER Type=2000 (Unknown), size = 447 bytes
0: 0100 0ccc cccc 0012 8037 1b9d 01b1 aaaa ………7……
16: 0300 000c 2000 02b4 f6c7 0001 000f 4c49 …. ………MY
32: 565f 3435 3036 3a30 3100 0501 2443 6973 S_4506:01…$Cis
48: 636f 2049 6e74 6572 6e65 7477 6f72 6b20 co Internetwork
64: 4f70 6572 6174 696e 6720 5379 7374 656d Operating System
80: 2053 6f66 7477 6172 6520 0a49 4f53 2028 Software .IOS (
96: 746d 2920 4361 7461 6c79 7374 2034 3030 tm) Catalyst 400
112: 3020 4c33 2053 7769 7463 6820 536f 6674 0 L3 Switch Soft
128: 7761 7265 2028 6361 7434 3030 302d 4939 ware (cat4000-I9
144: 532d 4d29 2c20 5665 7273 696f 6e20 3132 S-M), Version 12
160: 2e32 2831 3829 4557 322c 2052 454c 4541 .2(18)EW2, RELEA
176: 5345 2053 4f46 5457 4152 4520 2866 6331 SE SOFTWARE (fc1
192: 290a 5465 6368 6e69 6361 6c20 5375 7070 ).Technical Supp
208: 6f72 743a 2068 7474 703a 2f2f 7777 772e ort: http://www.
224: 6369 7363 6f2e 636f 6d2f 7465 6368 7375 cisco.com/techsu
240: 7070 6f72 740a 436f 7079 7269 6768 7420 pport.Copyright
256: 2863 2920 3139 3836 2d32 3030 3420 6279 (c) 1986-2004 by
272: 2063 6973 636f 2053 7973 7465 6d73 2c20 cisco Systems,
288: 496e 632e 0a43 6f6d 7069 6c65 6420 4d6f Inc..Compiled Mo
304: 6e20 3031 2d4e 6f76 2d30 3420 3136 3a32 n 01-Nov-04 16:2
320: 3320 6279 206b 656c 6c79 7468 7700 0600 3 by kellythw…
336: 1263 6973 636f 2057 532d 4334 3530 3600 .cisco WS-C4506.
352: 0200 1100 0000 0101 01cc 0004 ac15 63a6 …………..c.
368: 0003 0014 4661 7374 4574 6865 726e 6574 ….FastEthernet
384: 332f 3436 0004 0008 0000 0028 0009 000e 2/23…….(….
400: 6c69 7669 6e67 7374 6f6e 000a 0006 0015 location……
416: 000b 0005 0100 1200 0500 0013 0005 0000 …………….
So, the switch is “MYS_4506″ and it’s connected to FastEthernet 2/23 (fa2\23 in switch parlance)
I’ve been trying to extend this into a script - which kinda nearly works.
# more find_switch.sh
#!/bin/ksh# First, the theory -
# We can (eventually) get some output from snoop -x that
# tells us the switch, port and port type that the interface is
# connected to. This does mean running snoop for a while, so
# I’ll pipe this to a file and kill the snoop once we get a match.do_snoop()
{
pid=$(ps -ef | grep snoop | grep -v grep | awk ‘{print $2}’)
if [[ $pid == "" ]]
then
snoop -x 1 -d $interface 2>&1 >> /tmp/snoop.$interface &
sleep 1
pid=$(ps -ef | grep snoop | grep -v grep | awk ‘{print $2}’)
echo “Process is $pid”
else
echo “Snoop already running, bailing out.”
fi
}parse_output()
{
match=0
cat /tmp/snoop.$interface|while read line
do
if [[ $match -eq 2 ]]
then
if [[ $line == "" ]]
then
match=3
else
print -n “$(echo $line | cut -d\ -f10-)”
fi
fiif [[ $match -eq 1 ]]
then
if [[ $line == "" ]]
then
match=2
fi
fi
if [[ $(echo $line|grep -c Unknown) -eq 1 ]]
then
echo “Match”
match=1
fiif [[ $match -eq 3 ]]
then
echo “Done”
fi
done
}# Get the interfaces
ifconfig -a |grep “:”|grep -v lo0|while read line
do
interface=$(echo $line | cut -d\: -f1)
echo “Checking interface $interface”
do_snoop
# Go grep the output until theres a match
found=0
while [[ $found -eq 0 ]]
do
found=$(grep -c Eth /tmp/snoop.$interface)
sleep 1
done
echo “Killing $pid”
kill $pid
# parse the output
parse_output
done
Doesn’t quite work - the parsing part is a bit on the dodgy side, and if it doesn’t work, it could fill the /tmp fileystem.
Seems to be effective for Cisco switches, not sure about anything else.