Switch ARP table integration to map devices connection ports to a switch.

[zilvernet]

I thinking it would be useful to have some way to integrate or import the arp tables from a switch so that we can map automatically what ports are the macs being assigned to...

For example on this cisco switch you can see what ports are being used by what mac addresses.

There are some scenarios that need to be considered.

Access Points: the mac of the AP will share the switch port with their wireless peers.

When a device is recognize as wifi because of its shared value with an AP if would be great also to know the ssid name.
there is no specific field to place ssid info, so right now im using port field. (i think we should considered to add a new one for ssid).

Uplink Ports to another Switch: We need to identify if this port to avoid replacing a host indirect connection.
(on my example port 49 is an uplink port to another switch and the other macs shown on this port we don't want to replace on the hosts port value) you should consider all the switches arp table and determine which on is the most direct.

None smart switches: do not have arp table so here we will share the same port for the peer of the none smart switch.
but it would be nice to some how recognize that the same port is used on another host and is posible there is a switch on the middle.

Having an active integration with the network switches ARP tables can make this solution very powerful in identifying and mapping networks very quickly in addition to have updated info when something changes on the network, with minimal manual work.

[jokob-sk]

Hi @zilvernet ,

That would be an amazing feature. Unfortunately, I don't think I have the hardware to test such a feature on my network. I only have Unifi devices.

I you know how to code I can show you/guide you how this could be implemented for Cisco devices if they have an API.

The approach would be the following one:

1. Make yourself familiar with the plugin structure, especially column mapping: https://github.com/jokob-sk/NetAlertX/tree/main/front/plugins#-mapping-the-plugin-results-into-a-database-table The columns to add the parent node mac and port numbers are called dev_Network_Node_MAC_ADDR and dev_Network_Node_port.
2. Create a new folder in the /plugins/ directory, such as cisco_import
3. Copy over files from e.g. the arp_scan folder.
4. Go thru the config.json and adjust the properties where needed. Refer back to the first documentation link for details of what property does what.
5. Adjust the script.py to call the cisco API instead of the arp-scan API. You can also check other plugins for inspiration. So:

• Instad of calling execute_arpscan you would create a method e.g. get_cisco_devices
• the you map the necessary fields accordingly

Happy to help you to write some basic structure, but again, I don't have where to test the code and I know it's very difficult to implement something without me being able to test this and iterate quickly (unless if there is a testing cisco setup somewhere with a testing API which I can use).

Looking forward if you decide to help out!
j

[zilvernet]

Hi @jokob-sk I'm glad that you liked the idea, let's do it...

I can put in basic python code to test or make the proof of concept. (But im not a proficient developer, I think I will need some help).
I will setup a Lab environment with different equipment Cisco Switches and Netgear Switches and some APs and give you remote access for our test. I think the most generic way to integrate with any switch even Unify should be using SNMP
that way the only custom code for each switch should be their specific oid: the rest should be a generic code for all switches.

I will start setting up the environment and then I will DM you the info.

[jokob-sk]

Great, looking forwards to the collab 👍💪

If its SNMP we could improve the exiting SNMP plugin. Will think about it 🤔