Network management software

**Blaqb0x** · 10-25-2002, 11:30 AM

Hi,

Suppose I have a couple of class C networks. Most of the client hosts on the networks get their addresses from DHCP so if anyone plugs their machine into one of my switches then they will get an IP and I will know that there is a new machine using one of my IP's. However what if someone gets smart and just guesses which IP is open and sets their machine to use a static address. THen I wouldn't know that they are using one of my IP address. So my question is... is there some SW out there that can keep track of all the machines on the network via their MAC? That way even though they are using a static IP thier MAC will show on the SW and not on the DHCP server and Ill know.

thanx,

**mmiller9** · 10-25-2002, 12:32 PM

If you are using a managed switch telnet into it and look around the options there some switches that have an option to show learned mac addresses. This is the case with the Nortel equipment that we use. i can't say for 3com or other venders but it is worth a look.

**mmiller9** · 10-25-2002, 12:39 PM

We have another type of switched hub made by cabletron you can find connected macs under the option for 802.1 configuration menu. Hope that this helps some.

**trickster** · 10-25-2002, 12:43 PM

You can just set regularly ip scans on your network. That way, you can see what hosts are using your ip addresses, no matter if they are getting them from DHCP or static ones. Then, it is a matter of comparing the scan list with your DHCP list. For windows, you can try Angry IP Scanner, http://www.angryziber.com/ipscan/ I don't know any for linux, but I am sure there must be some out there.

EDIT:
Angry IP Scanner can even list you MAC addresses if the hosts are running NetBios or Samba.

**Blaqb0x** · 10-30-2002, 10:50 PM

Well what Im really looking for is a centralized host management solution.

How can you completely know what IP's are active or not active.

What Host(NIC) is actually using an IP?

I'm actually in the process of writing some PERL scripts that will parse the MAC & IP data from ARP tables after an nmap ping scan of a whole Class C subnet. Would anyone be interested in using it on their own network to help me test it? basically a cron job w/ NMAP and a PERL script that emails you if some conditions are met ie a non registered IP is active. I think a tool like this would be every sys admins dream.

I've still got some bugs to work out but it's coming along.

thanx,

**trickster** · 10-31-2002, 12:00 AM

AFAIK , Angry IP will do all the stuff you are asking from it. Only thing is that it is a Windows tool, and that the pinging might increase network traffic. However, I think the script you are referring to will do that anyway.