Mac Address per Port

VonRC · Joined: 18 Jan 2007 Posts: 6

Is it possible to count the number of mac addresses for a given port on a Cisco device and graph it over time? I'm trying to find rouge hubs before I turn on port security and limit to 1 per port.

RC

TheWitness · Posted: Thu Jan 18, 2007 7:39 pm Post subject:

That's an interesting thought...

TheWitness

VonRC · Joined: 18 Jan 2007 Posts: 6

TheWitness · Posted: Fri Jan 19, 2007 6:37 am Post subject:

Yes, it lines up with a port inventory feature that I have been convinced is appropriate method to extend the capabilities of the system. However, my creative juices are a bit drained at the moment.

Looking for more inspiration.

TheWitness

egarnel · Posted: Fri Jan 19, 2007 9:00 am Post subject: Re: Mac Address per Port

VonRC · Joined: 18 Jan 2007 Posts: 6

VonRC · Joined: 18 Jan 2007 Posts: 6

broken post

VonRC · Joined: 18 Jan 2007 Posts: 6

A few obvious things:
1. The CAM table has a list of all the MAC addresses and the port number they were learned on.
2. Port security has a method to track the MAC count to enforce the security policy.

Its easy to get the CAM table via SNMP but does port security have an entry in the tree somewhere or does it just calculate the number from the CAM table?

Help me out here. I

TheWitness · Posted: Sat Jan 20, 2007 12:55 pm Post subject:

This information is already scanned in the current product.

TheWitness

VonRC · Joined: 18 Jan 2007 Posts: 6

A few obvious things:
1. The CAM table has a list of all the MAC addresses and the port number they were learned on.
2. Port security has a method to track the MAC count to enforce the security policy.

It

VonRC · Joined: 18 Jan 2007 Posts: 6

A few obvious things:
1. The CAM table has a list of all the MAC addresses and the port number they were learned on.
2. Port security has a method to track the MAC count to enforce the security policy.

It

VonRC · Joined: 18 Jan 2007 Posts: 6

I can't get my post up on the system... It keeps cutting me off. One more try only I will type it in rather than copy paste...

A few obvious things:

1. The CAM table has a list of all the MAC addresses and the port number they were learned on.
2. Port secruity has a method to track the MAC count to enforce the security policy.

It's easy to get the CAM table fiaq SNMP but doesn port security have an entry in the tree somewhere or does it just calculate the number from the CAM table?

Help me out here. I'm not sure if I'm gong to make this understandable.

We can get the CAM table and put it in a Temp SQL table and run a query something like this on it;

select port_id
count (port_id) AS NumOccurrences
from temptable
group by port_id

Once we have the NumOccurrences we could shove that in to a real table in the SQL server with a time stamp and switch id. From there it would be just a matter of getting the data back out and graphing it.

The problem is I just don't know how to put it all together and make it work.

RC

TheWitness · Posted: Sat Jan 20, 2007 6:21 pm Post subject:

Did you not read my prior post?

VonRC · Joined: 18 Jan 2007 Posts: 6

TheWitness · Posted: Sat Jan 20, 2007 9:36 pm Post subject:

lol. The forum's been having issues lately. Looks like the site was down for a little bit today. Although, truth be known, I think there were some DNS issues on the web this morning.

TheWitness