Subversion Repositories sysadmin_scripts

Rev

Rev 63 | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 63 Rev 66
Line 1... Line 1...
1
#! /usr/bin/env perl
1
#! /usr/bin/env perl
2
 
2
 
3
# Script does an snmp walk through the ports of one or more network
3
# Script does an snmp walk through the ports of one or more network
4
# switch, gathering MAC addresses assigned to each port.
4
# switch, gathering MAC addresses assigned to each port.
5
# 
5
# 
6
# requires snmp running on this machine. Also uses YAML::Tiny perl module
-
 
7
# under debian and derivatives, use the following command to install
-
 
8
# apt-get -y install snmp libyaml-tiny-perl
-
 
9
#
-
 
10
# It then does an snmp walk through the arp table of one or
6
# It then does an snmp walk through the arp table of one or
11
# more routers to determine IP and DNS entries for the MAC address
7
# more routers to determine IP and DNS entries for the MAC address
12
# 
8
# 
13
# Information gathered is stored in persistent storage (a yaml formatted file
9
# Information gathered is stored in persistent storage (a yaml formatted file
14
# in the same directory), then reloaded at the next start of the program.
10
# in the same directory), then reloaded at the next start of the program.
15
# As new entries become available, they are added. A time stamp
11
# As new entries become available, they are added. A time stamp
16
# records the last time an entry was "seen"
12
# records the last time an entry was "seen"
-
 
13
#
-
 
14
# requires snmp running on this machine. Also uses YAML::Tiny perl module
-
 
15
# under debian and derivatives, use the following command to install
-
 
16
# apt-get -y install snmp libyaml-tiny-perl
17
 
17
#
-
 
18
#
18
# Data is stored in the hash %switchports with the following structure
19
# Data is stored in the hash %switchports with the following structure
19
# %switchports =
20
# %switchports =
20
#     {switch} (from $config{'switches'} key)
21
#     {switch} (from $config{'switches'} key)
21
#        {name} (scalar, from snmp)
22
#        {name} (scalar, from snmp)
22
#        {location} (scalar, from snmp)
23
#        {location} (scalar, from snmp)
Line 25... Line 26...
25
#              {connection} (uniqe id from snmp, basically the MAC)
26
#              {connection} (uniqe id from snmp, basically the MAC)
26
#                 {mac} (from snmp walk of switch)
27
#                 {mac} (from snmp walk of switch)
27
#                 {ip}  (from snmp walk of router)
28
#                 {ip}  (from snmp walk of router)
28
#                 {hostname} (from reverse dns query)
29
#                 {hostname} (from reverse dns query)
29
#                 {lastseen} (last time this was active as unix timestamp)
30
#                 {lastseen} (last time this was active as unix timestamp)
-
 
31
#
-
 
32
# Uses two external files, both in the same directory as the script
-
 
33
# mapSwitches.config.yaml - Configuration file. See makeConfig.pl.sample for documentation. This can be created if  you, like
-
 
34
#                           me, are more comfortable with perl syntax. Once edited, run it to create the .yaml config file
-
 
35
# mapSwitches.yaml -        a state file which maintains information across executions. This allows us to track connections
-
 
36
#                           which are not on all the time. Can be deleted at any time for a fresh start. Can be dumped into a
-
 
37
#                           tab delimited text file (to STDOUT) with helper script mapSwitchesCSV.pl
-
 
38
#
30
 
39
 
31
# 20190407 RWR
40
# 20190407 RWR
32
# converted to use external config file in YAML format
41
# converted to use external config file in YAML format
33
# added the ability to ignore ports on the switches
42
# added the ability to ignore ports on the switches
34
# 20190514 RWR
43
# 20190514 RWR
35
# Added port aliases
44
# Added port aliases
36
# 20190526 RWR
45
# 20190526 RWR
37
# fixed mapSwitchCSV.pl to output in various delimited format (see README)
46
# fixed mapSwitchCSV.pl to output in various delimited format (see README)
38
# 20200107 RWR
47
# 20200107 RWR v1.3
39
# Fixed problem where alias MIB was not returning values
48
# Fixed problem where alias MIB was not returning values
-
 
49
# 20200228 RWR v1.4
-
 
50
# added description MIB and field
-
 
51
# 20200229 RWR v2.0.0
-
 
52
# rewrite, with 80% of the code changed. Found serious flaws with the way the ports were being read and fixed them.
-
 
53
# also set it up so it is a little more concise by combining redundant code into one routine, parseSNMPQuery, which
-
 
54
# reads an snmp walk and returns the results as a hash
40
 
55
 
41
use strict;
56
use strict;
42
use warnings;
57
use warnings;
43
use Data::Dumper; # only used for debugging
58
use Data::Dumper; # only used for debugging
44
use Socket; # for reverse dns entries
59
use Socket; # for reverse dns entries
Line 46... Line 61...
46
use File::Spec; # find location of script so we can put storage in same directory
61
use File::Spec; # find location of script so we can put storage in same directory
47
use File::Basename;
62
use File::Basename;
48
 
63
 
49
my $DEBUG = 0;
64
my $DEBUG = 0;
50
 
65
 
-
 
66
# define the version number
-
 
67
# see https://metacpan.org/pod/release/JPEACOCK/version-0.97/lib/version.pod
-
 
68
use version;
51
our $VERSION = '1.3';
69
our $VERSION = version->declare("v2.0.0");
-
 
70
 
-
 
71
# see https://perldoc.perl.org/Getopt/Long.html
-
 
72
use Getopt::Long;
-
 
73
# allow -vvn (ie, --verbose --verbose --dryrun)
-
 
74
Getopt::Long::Configure ("bundling");
52
 
75
 
-
 
76
 
-
 
77
 
53
my %config;
78
my %config; # we read the configuration file into this
54
 
79
 
55
# where the script is located
80
# where the script is located
56
my $scriptDir = dirname( File::Spec->rel2abs( __FILE__ ) );
81
my $scriptDir = dirname( File::Spec->rel2abs( __FILE__ ) );
57
# put the statefile in there
82
# put the statefile in there
58
my $STATEFILE = $scriptDir . '/mapSwitches.yaml';
83
my $STATEFILE = $scriptDir . '/mapSwitches.yaml';
59
my $CONFIGFILE = $scriptDir . '/mapSwitches.config.yaml';
84
my $CONFIGFILE = $scriptDir . '/mapSwitches.config.yaml';
60
# main hash that holds the data we collect
85
# main hash that holds the data we collect
61
my %switchports;
86
my %switchports;
62
# some OIDS we need for the program
-
 
63
my $SWITCHPORTMIB  = 'iso.3.6.1.2.1.17.4.3.1.2';
-
 
64
my $SWITCHMACMIB   = 'iso.3.6.1.2.1.17.4.3.1.1';
-
 
65
my $SWITCHIFNAMEMIB = '1.3.6.1.2.1.31.1.1.1.18';
-
 
66
my $ROUTERIPMACMIB = 'iso.3.6.1.2.1.4.22.1.2'; #'iso.3.6.1.2.1.3.1.1.2';
-
 
67
my $DEVICENAMEMIB  = '1.3.6.1.2.1.1.5';
-
 
68
my $DEVICELOCMIB   = '1.3.6.1.2.1.1.6';
-
 
69
 
87
 
-
 
88
# OID's to read the swtiches
-
 
89
# NOTE: for the regular expressions to work, you must use iso. for the OID
-
 
90
 
-
 
91
#my $SWITCHPORTMIB  = 'iso.3.6.1.2.1.17.4.3.1.2';
-
 
92
my $SWITCHPORTMIB  = 'iso.3.6.1.2.1.2.2.1.8';
-
 
93
my $SWITCHMACMIB   = 'iso.3.6.1.2.1.17.4.3.1.1'; # dot1dTpFdbAddress, aka mac addresses
-
 
94
my $SWITCHIFALIASMIB = 'iso.3.6.1.2.1.31.1.1.1.18'; # ifAlias, the the 'alias' field
-
 
95
my $SWITCHIFDESCMIB = 'iso.3.6.1.2.1.2.2.1.2'; # ifDescr, the "description" field
-
 
96
my $BRIDGEPORTSMIB = 'iso.3.6.1.2.1.17.4.3.1.2';
-
 
97
my $BRIDGE2PORTMIB = 'iso.3.6.1.2.1.17.1.4.1.2';
-
 
98
# this is only for the router, to get IP of the device in question
-
 
99
my $ROUTERIPMACMIB = 'iso.3.6.1.2.1.4.22.1.2'; # ipNetToMediaPhysAddress #'iso.3.6.1.2.1.3.1.1.2';
-
 
100
# this should work for all devices
-
 
101
my $DEVICENAMEMIB  = 'iso.3.6.1.2.1.1.5'; # sysname
-
 
102
my $DEVICELOCMIB   = 'iso.3.6.1.2.1.1.6'; # syslocation
-
 
103
 
-
 
104
# take a dotted integer form of a mac and converts it to hex, all lower case
70
sub makeMAC {
105
sub makeMAC {
71
   my $string = shift;
106
   my $string = shift;
72
   my @octets = split( '\.', $string );
107
   my @octets = split( '\.', $string );
73
   for ( my $i = 0; $i < @octets; $i++ ) {
108
   for ( my $i = 0; $i < @octets; $i++ ) {
74
      $octets[$i] = sprintf( "%02x", $octets[$i] );
109
      $octets[$i] = sprintf( "%02x", $octets[$i] );
75
   }
110
   }
76
   return join( '', @octets );
111
   return join( '', @octets );
77
}
112
}
78
 
113
 
-
 
114
# simply updates a value. First parameter ($oldValue) is passed by reference so it can be directly accessed
-
 
115
# returns 1 on success, 0 on failure
79
sub updateValue {
116
sub updateValue {
80
   my ( $oldValue, $newValue ) = @_;
117
   my ( $oldValue, $newValue ) = @_;
81
   $newValue = '' unless defined $newValue;
118
   $newValue = '' unless defined $newValue;
82
   if ( $newValue ) {
119
   if ( $newValue ) {
83
      $$oldValue = $newValue unless $newValue eq $$oldValue;
120
      $$oldValue = $newValue unless $newValue eq $$oldValue;
84
      return 1;
121
      return 1;
85
   }
122
   }
86
   return 0;
123
   return 0;
87
}
124
}
88
 
125
 
-
 
126
# grabs one single SNMP value from string. Assumes $OID returns only one line, then runs $regex against it.
89
sub getOneSNMPValue {
127
sub getOneSNMPValue {
90
   my ( $oid, $community, $ip, $regex ) = @_;
128
   my ( $oid, $community, $ip, $regex ) = @_;
91
   my $line = `snmpwalk -v1 -c $community $ip $oid`;
129
   my $line = `snmpwalk -v1 -c $community $ip $oid`;
92
   $line =~ m/$regex/i;
130
   $line =~ m/$regex/i;
93
   return $1;
131
   return $1;
94
}
132
}
95
 
133
 
-
 
134
# ensures a hash has $name with every value in @keys
-
 
135
# call with &initialize( \%hash, 'somename', 'key1','key2');
-
 
136
# will ensure $hash->{somename}->{key1} and $hash->{somename}->{key2} exist
96
sub initialize {
137
sub initialize {
97
   my ( $hash, $name, @keys ) = @_;
138
   my ( $hash, $name, @keys ) = @_;
98
   foreach my $key ( @keys ) {
139
   foreach my $key ( @keys ) {
99
      $hash->{$name}->{$key} = '' unless $hash->{$name}->{$key};
140
      $hash->{$name}->{$key} = '' unless $hash->{$name}->{$key};
100
   }
141
   }
101
}
142
}
102
 
143
 
-
 
144
# updates the lastseen time on a mac address by searching through $switchports until it finds it. If it doesn't exist, will
-
 
145
# add it.
103
sub updateIP {
146
sub updateIP {
104
   my ( $switchports, $ip, $mac ) = @_;
147
   my ( $switchports, $ip, $mac ) = @_;
105
   foreach my $switch ( keys %$switchports ) {
148
   foreach my $switch ( keys %$switchports ) {
106
      my $thisSwitch = $switchports->{$switch}->{'ports'};
149
      my $thisSwitch = $switchports->{$switch}->{'ports'};
107
      foreach my $port ( keys %$thisSwitch ) {
150
      foreach my $port ( keys %$thisSwitch ) {
108
         my $thisPort = $thisSwitch->{$port};
151
         my $thisPort = $thisSwitch->{$port};
109
         foreach my $connection ( keys %$thisPort ) {
152
         foreach my $connection ( keys %$thisPort ) {
110
            # skip the alias information on a port
153
            # skip the alias information on a port
111
            next if $connection eq 'alias';
154
            next if $connection eq 'alias' or $connection eq 'description';
112
            &initialize( $thisPort,$connection,'mac','ip','hostname','lastseen' );
155
            &initialize( $thisPort,$connection,'mac','ip','hostname','lastseen' );
113
            if ( $switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'mac'} eq $mac ) {
156
            if ( $switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'mac'} eq $mac ) {
114
               my $modified = &updateValue( \$switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'ip'}, $ip );
157
               my $modified = &updateValue( \$switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'ip'}, $ip );
115
               $modified |= &updateValue( \$switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'hostname'},gethostbyaddr( inet_aton( $ip ), AF_INET ));
158
               $modified |= &updateValue( \$switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'hostname'},gethostbyaddr( inet_aton( $ip ), AF_INET ));
116
               $switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'lastseen'} = time() if $modified;
159
               $switchports->{$switch}->{'ports'}->{$port}->{$connection}->{'lastseen'} = time() if $modified;
Line 119... Line 162...
119
         } # for connection
162
         } # for connection
120
      } # for port
163
      } # for port
121
   } # for switch
164
   } # for switch
122
} # updateIP
165
} # updateIP
123
 
166
 
-
 
167
 
-
 
168
# runs an snmpwalk using $MIB, then for each line, splits it with a regex
-
 
169
# if order is set to 12, first value of regex is a key, else second value is the key
124
sub getAliases {
170
sub parseSNMPQuery {
125
   my ($ip, $community, $MIB ) = @_;
171
   my ($config, $switch, $MIB, $regex, $order) = @_;
126
   my %return;
172
   $order = 12 unless $order;
127
   # get the aliases
173
   my $return = {};
128
   my $values = `snmpwalk -v1 -c $community $ip $MIB`;
174
   my $values = `snmpwalk -v1 -c $config{switches}{$switch}{'community'} $switch $MIB`;
129
   my @aliases = split( "\n", $values );
175
   foreach my $line ( split( "\n", $values ) ) {
130
   chomp @aliases;
176
      $line =~ m/$regex/;
131
   foreach my $entry ( @aliases ) {
177
      if ( $order == 12 ) {
132
      if ( $entry =~ m/\.(\d+) = STRING: "?([^"]*)"?$/ ) {
178
         $return->{$1} = $2;
-
 
179
      } else {
133
         $return{$1} = $2;
180
         $return->{$2} = $1;
134
      }
181
      }
135
   }
182
   }
136
   return \%return;
183
   return $return;
137
}
184
}
138
   
185
   
-
 
186
# simple display if --help is passed
-
 
187
sub help {
-
 
188
   use File::Basename;
-
 
189
   print basename($0) . " $VERSION\n";
-
 
190
   print <<END
-
 
191
$0 [options]
-
 
192
Options:
-
 
193
   --debug          - set debug level
-
 
194
   --version        - display version and exit
-
 
195
   --help           - This page
-
 
196
END
-
 
197
}
-
 
198
 
139
 
199
 
-
 
200
# handle any command line parameters that may have been passed in
-
 
201
my $version = 0; # just used to determine if we should display the version
-
 
202
my $help = 0; # also if we want help
-
 
203
GetOptions (
-
 
204
            'debug|d=i'     => \$DEBUG,
-
 
205
            'help|h'        => \$help,
-
 
206
            'version|v'     => \$version,
-
 
207
            ) or die "Error parsing command line\n";
-
 
208
 
-
 
209
                  
-
 
210
if ( $help ) { &help() ; exit; }
-
 
211
if ( $version ) { use File::Basename; print basename($0) . " $VERSION\n"; exit; }
-
 
212
 
-
 
213
# Load configuration file, die if we could not find it
140
if ( -e $CONFIGFILE ) {
214
if ( -e $CONFIGFILE ) {
141
   my $yaml = YAML::Tiny->read( $CONFIGFILE );
215
   my $yaml = YAML::Tiny->read( $CONFIGFILE );
142
   %config = %{ $yaml->[0] };
216
   %config = %{ $yaml->[0] };
143
} else {
217
} else {
144
   die "could not locate config file $CONFIGFILE\n";
218
   die "could not locate config file $CONFIGFILE\n";
Line 154... Line 228...
154
foreach my $switch ( keys %{$config{'switches'}} ) {
228
foreach my $switch ( keys %{$config{'switches'}} ) {
155
   print "Working on $switch\n" if $DEBUG;
229
   print "Working on $switch\n" if $DEBUG;
156
   &initialize( \%switchports, $switch, 'name','location' );
230
   &initialize( \%switchports, $switch, 'name','location' );
157
   &updateValue(
231
   &updateValue(
158
      \$switchports{$switch}{'name'},
232
      \$switchports{$switch}{'name'},
159
      &getOneSNMPValue( $DEVICENAMEMIB,$config{'switches'}{$switch}{'community'},$switch, '= STRING: "?([^"]*)"?' )
233
      &getOneSNMPValue( $DEVICENAMEMIB,$config{'switches'}{$switch}{'community'},$switch, qr/= STRING: "?([^"]*)"?/ )
160
      );
234
      );
161
 
235
 
162
   &updateValue(
236
   &updateValue(
163
      \$switchports{$switch}{'location'},
237
      \$switchports{$switch}{'location'},
164
      &getOneSNMPValue( $DEVICELOCMIB,$config{'switches'}{$switch}{'community'},$switch, '= STRING: "?([^"]*)"?' )
238
      &getOneSNMPValue( $DEVICELOCMIB,$config{'switches'}{$switch}{'community'},$switch, qr/= STRING: "?([^"]*)"?/ )
165
      );
239
      );
-
 
240
 
-
 
241
   # get list of all active ports not in our ignore list
-
 
242
   print "\tGetting Ports\n" if $DEBUG > 1;
-
 
243
   my $ports = parseSNMPQuery( \%config, $switch, $SWITCHPORTMIB, qr/$SWITCHPORTMIB\.(\d{1,3})\s=\sINTEGER:\s+(\d+)/ );
166
   # get the MAC addresses
244
   #die Dumper( $ports );
-
 
245
   print "\tGetting Aliases\n" if $DEBUG > 1;
167
   my $values = `snmpwalk -v1 -c $config{switches}{$switch}{'community'} $switch $SWITCHPORTMIB`;
246
   my $aliases = parseSNMPQuery( \%config, $switch, $SWITCHIFALIASMIB, qr/\.(\d+) = STRING: "?([^\"]*)\"?$/ );
168
   my @lines = split( "\n", $values );
247
   #die Dumper( $aliases );
-
 
248
   print "\tGetting Descriptions\n" if $DEBUG > 1;
169
   my $aliases = getAliases ( $switch, $config{switches}{$switch}{'community'}, $SWITCHIFNAMEMIB );
249
   my $descriptions = parseSNMPQuery( \%config, $switch, $SWITCHIFDESCMIB, qr/\.(\d+) = STRING: "?([^\"]*)"?$/ );
-
 
250
   #die Dumper( $descriptions );
170
   
251
   
171
   foreach my $line ( @lines ) {
252
   foreach my $port ( keys %$ports ) {
172
      $line =~ m/$SWITCHPORTMIB\.([0-9.]+)\s=\sINTEGER:\s+(\d+)/;
253
      if ( $ports->{$port} == 1 ) { # only work with ports that are active
-
 
254
         next if $config{'switches'}{$switch}{'portsToIgnore'} && grep( /^$port$/, @{$config{'switches'}{$switch}{'portsToIgnore'}} );
173
      my $uuid = $1; # this is the ID string of this MAC; normally the MAC itself in decimal form
255
         $switchports{$switch}{'ports'}{$port}{'alias'} = $aliases->{$port} ? $aliases->{$port} : '';
-
 
256
         $switchports{$switch}{'ports'}{$port}{'description'} = $descriptions->{$port} ? $descriptions->{$port} : '';
-
 
257
      }
-
 
258
   }
-
 
259
   # die Dumper( \%switchports );
-
 
260
 
-
 
261
   # now, get the MAC addresses. See https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/44800-mactoport44800.html
-
 
262
   print "\tFinding Mac Addresses\n" if $DEBUG > 1;
-
 
263
   my $macs = parseSNMPQuery( \%config, $switch, $SWITCHMACMIB, qr/$SWITCHMACMIB\.([0-9.]+)\s=\sHex-STRING:\s+([0-9a-z ]+)$/i );
-
 
264
   #die Dumper( $macs );
174
      my $port = $2; # this is the port number
265
   # find which bridges they are on
175
      next unless $port; # skip port 0, or any port which has nothing
266
   print "\t\tFinding what bridges the MAC's are on\n" if $DEBUG > 2;
176
      next if $config{'switches'}{$switch}{'portsToIgnore'} && grep( /^$port$/, @{$config{'switches'}{$switch}{'portsToIgnore'}} );
267
   my $macBridges = parseSNMPQuery( \%config, $switch, $BRIDGEPORTSMIB, qr/$BRIDGEPORTSMIB\.([0-9.]+)\s=\sINTEGER:\s+(\d+)/ );
-
 
268
   #die Dumper( $macBridges );
177
      $switchports{$switch}{'ports'}{$port}{$uuid}{'mac'} = &makeMAC( $1 );
269
   print "\t\tFinding what ports the ports are\n" if $DEBUG > 2;
-
 
270
   my $bridgeToPort = parseSNMPQuery( \%config, $switch, $BRIDGE2PORTMIB, qr/$BRIDGE2PORTMIB\.([0-9.]+)\s=\sINTEGER:\s+(\d+)/ );
-
 
271
   #die Dumper( $bridgeToPort );
-
 
272
   foreach my $mac ( keys %$macs ) {
178
      $switchports{$switch}{'ports'}{$port}{'alias'} = $aliases->{$port} ? $aliases->{$port} : '';
273
      $switchports{$switch}{'ports'}{$bridgeToPort->{$macBridges->{$mac}}}{$mac}{'mac'} = &makeMAC($mac);
179
   }
274
   }
180
}
275
}
181
 
276
 
182
# die Dumper( \%switchports );
277
#die Dumper( \%switchports );
183
 
278
 
184
 
279
 
185
# Now, try to match up the MAC address. Read the ARP table from the router(s)
280
# Now, try to match up the MAC address. Read the ARP table from the router(s)
186
foreach my $router ( keys %{$config{'routers'}} ) {
281
foreach my $router ( keys %{$config{'routers'}} ) {
-
 
282
   print "Working on $router\n" if $DEBUG;
187
   my $values = `snmpwalk -v1 -c $config{routers}{$router}{community} $router $ROUTERIPMACMIB`;
283
   my $values = `snmpwalk -v1 -c $config{routers}{$router}{community} $router $ROUTERIPMACMIB`;
188
   my @lines = split( "\n", $values );
284
   my @lines = split( "\n", $values );
189
   foreach my $line ( @lines ) {
285
   foreach my $line ( @lines ) {
190
      $line =~ m/$ROUTERIPMACMIB\.([0-9]+)\.([0-9.]+)\s=\sHex-STRING:\s([0-9a-z ]+)/i;
286
      $line =~ m/$ROUTERIPMACMIB\.([0-9]+)\.([0-9.]+)\s=\sHex-STRING:\s([0-9a-z ]+)/i;
191
      my $interface = $1;
287
      my $interface = $1;