Page under construction
This project consists of three major modules netdisc, netvis and netreport.
What is netdisc?
netdisc is a network discovery utility that uses SNMP to discover the
structure of IP networks.
netdisc retrieves a number of MIB variables,
primarily from the MIB-2 IP group, including the
ip.ipNetToMediaTable (IP ARP table),
ip.ipAddrTable (IP address table) and interfaces.
ifTable (IP interface tables).
Based on that information and a few other items, netdisc will discover
the topology of an SNMP-managed IP subnet-based
network. netdisc also can distinguish the
difference between routers and hosts, and
will output two lists, routers.ip and hosts.ip, as separate
files.
How to use netdisc?
netdisc is typically started with no options.
It reads its configuration from /etc/netdisc.conf if it exists.
Otherwise, it will try to read configuration
from $HOME/netdisc.conf. netdisc only reads the configuration
file when it starts up, and never writes it.
Command Line Syntax :
netdisc [-c config-file]
[-rid run-id] [-d] [-p] [-h]
-c config-file
Specifies the configuration file.
-rid run-id
Specifies the run-id. run-id is used to uniquely identify each run.
It is very useful if you want to
combine two different runs together. See netreport
for more information about run-id.
-h Prints out a help message
-d Enable debugging.
This switch causes netdisc to print copious debugging information to standard
output. This is probably a good idea on the first few runs
at any site.
-p Parse configuration
file. With this flag, netdisc merely parses the configuration
file and exits.
If netdisc successfully parses the configuration, it dumps a description
of its internal variables
(similar to the output when -d is used).
How does netdisc work?
netdisc starts with a node, which is
called the starting point. The starting point should either be the
box
that netdisc is run on (which
must have a snmpd daemon and have ip.ipForwarding set to 1) or should be
an snmp-managed router in the network.
It will then retrieve MIB variables including the ip.ipForwarding
and interfaces.ifNumber. If netdisc
successfully obtains the MIB variables, then it decides if the node is
a
router or a host by checking the ip.ipForwarding.
If netdisc thinks the node looks like a router, then it
proceeds to retrieve the node's
ip.ipAddrTable and ip.ipNetToMediaTable. The ip.ipNetToMediaTable
is very important to the success
of the discovery process that is carried out by netdisc. netdisc
uses the
IP addresses in the ip.ipNetToMediaTable
to recursively explore the network and build up a list of discovered
nodes. Because the discovery process
is a recursive process, it will not stop unless netdisc thinks that a
termination condition is met. Termination
conditions include no information about the snmp password
(therefore netdisc will not follow
a link), and specific IP addresses which will cause netdisc to not
acquire
information from a link and hence not
explore further. As a result, netdisc can be taught to "not discover
the
Internet". See netdisc.conffor
more information about the termination conditions.
netdisc does not use ip.ipRouteTable (routing table) for the following two reasons:
Each line of a configuration file is a separate
statement. Each configuration option begins with a tag or keyword
and occupies one line. The syntax of
configuration options depends on the individual tag. Tags may take
zero
or more arguments. Blank lines and comment
lines beginning with a '#' in the first column may be used to add
whitespace or comments.
A configuration file may be tested (parsed)
by using netdisc -p. This switch causes netdisc to parse the
configuration file and then exit without actually
starting up. It will print out internal values and exit with a success
message if the configuration file can be parsed.
Contents of netdisc.conf
<hostID, Status, IpAddress, SubnetMask, IfNumNoIP, IfNumEthernet, IpForwarding, DNS, OID>
routerID
An Internal index that uniquely identify each router.
Status
Indicates the status of the node between two runs. It has four values,
which are SIN - single run,
BTH - the host exists in both runs, MIS - the host exist in the first run
but does not exist in the second
run (it is missing), and NEW - the host exist in the second run but does
not exist in the first run
(it is new).
IpAddress
Router's IP address
Subnetmask
Router's subnet mask
InterfaceID
An index that uniquely identify each interface in the MIB-II interfaces
group.
DNS
Domain name
OID
The SNMP Oject ID.
Usage
netreport [-r router-file] [-h host-file]
[-dns] [-s switch-file] [-i number-of-interface]
[-rid rid1 rid2 rid3] [-b]
netreport is typically started with at least
one option, which is the name of the file containing discovered routers
or the name of the file containing discovered
hosts. netreport then sorts the content of the file and performs
DNS lookups as required. The default
output file name is the input name with .sorted at the end.
-r router-file
Specifies the input file for discovered routers. Usually, this is the output
of netdisc.
-h host-file
Specifies the input file for discovered host. Usually, this is the output
of netdisc. With this option netreport
sorts the input host-file by host ID and outputs a file containing 8 columns
if no DNS lookup is required,
or 9 columns if DNS lookup is required. The format of the output file is
the following:
[hostID, Status, IP, netmask, i/f, ifNumNoIP, ifNumEthernet, DNS name(optional),
OID] .
-rid rid1 rid2 rid3
Instruct netreport to combine the outputs of two different runs (specified
by rid1 and rid2 ) of netdisc
into one file, whose ID is specified by rid3. netreport then
figures out the network changes between
two runs by giving each node a status, which has four possible values,
'SIN', 'BTH', 'MIS' and 'NEW'.
-s switch-file
Guess the switches from the hosts and output them to switch-file. The idea
is that if a host has a certain
number of interfaces that do not have IP addresses, it is possible that
the host is a switch. You can use
-i number-of-interface to specify how many interfaces a node has for it
to be considered as a switch.
By default, netreport uses 7 as the minimum number of interfaces
for switches.
-i number-of-interface
Specifiy the minium number of interfaces for switches.
-dns
Do DNS lookup. When this option is used, netreport will print out the resolved
names. If -r router-file
is specified, netreport sorts the input router-file by router ID
and outputs a file containing 6 columns if
no DNS lookup is required, or 7 columns if DNS lookup is required. The
format of the output file is the
following:
[routerID, Status, IP, netmask, interfaceID, DNS name(optional), OID] .
-b
Instruct netreport to generate a broadcast domain report. The report is
a plain text file. Each line of the
file contains the following columns:
[subnetID, netmask, numberOfHost, IP, snmpPort, Dns]
numberOfHost is the number of the hosts in the broadcast domain (a.k.a
subnet) specified by subnetID.
IP is the address of the router interface that belongs to the broadcast
domain and snmpPort is the ID of
that interface in SNMP term. If there is more than one router in that subnet,
there will be more than one
line like this. They will have the same subnetID and numberOfHost, but
different IP and snmpPort might
be different as well.