Pinging a set to find the missing cable / computer?

Archived from groups: comp.dcom.lans.ethernet (More info?)

Can anyone suggest software, esp. freeware, that will monitor a network in
some limited way?
Or is there a better newsgroup for this question?

I have one simple task right now. I need to identify unlabeled ethernet
cables - with their associated computer IP addresses. Here's the conceptual
approach I have in mind:

Plug a sniffer computer into a switch or hub.
(I'm unclear whether this will work on a switch....)
Repeatedly Ping all of the computers on the network - using a list or setup
of IP addresses.
Unplug one of the cables.
Have the missing computer(s) IP address identified (because the Ping fails)
Then I can figure out which cable is which.

Or, is there a better way?
It seems like this would be a common task.....

I'd like to be able to modify the IP list pretty readily. A text editor on
a list or lists would be acceptable.

Thanks,

Fred

Archived from groups: comp.dcom.lans.ethernet (More info?)

"Buzz Lightbeer" <buzz.lightbeer@spam.dsl.pipex.com> wrote in message news:<40a3c031$0$20514$cc9e4d1f@news-text.dial.pipex.com>...
> "Fred Marshall" <fmarshallx@remove_the_x.acm.org> wrote in message
> news:EfednSTzpaeB6T7dRVn_iw@centurytel.net...
> > Can anyone suggest software, esp. freeware, that will monitor a network in
> > some limited way?
> > Or is there a better newsgroup for this question?
> >
> > I have one simple task right now. I need to identify unlabeled ethernet
> > cables - with their associated computer IP addresses. Here's the
> conceptual
> > approach I have in mind:
> >
> > Plug a sniffer computer into a switch or hub.
> > (I'm unclear whether this will work on a switch....)
> > Repeatedly Ping all of the computers on the network - using a list or
> setup
> > of IP addresses.
> > Unplug one of the cables.
> > Have the missing computer(s) IP address identified (because the Ping
> fails)
> > Then I can figure out which cable is which.
> >
> > Or, is there a better way?
> > It seems like this would be a common task.....
> >
> > I'd like to be able to modify the IP list pretty readily. A text editor
> on
> > a list or lists would be acceptable.
> >
> > Thanks,
> >
> > Fred
> >
> >
> Why not interrogate the switch for it's mac-address-table then relate the
> mac addresses to IP addresses?

From: chris@nospam.com (chris@nospam.com)
Subject: Re: Get MAC-Address Table from Cisco router
Newsgroups: comp.dcom.sys.cisco
Date: 2004-05-18 22:14:40 PST

Says:

Do a search on cammer.pl. It's a perl script that queries a Cisco
switch and dumps a list of mac-address, port number, and IP (if you
also tell it a router that would have an arp table).

Archived from groups: comp.dcom.lans.ethernet (More info?)

<chris@nospam.com> wrote in message
news:n85ta05m5jvj88jo46fcnm3j12vuh61k1o@4ax.com...
> On 19 May 2004 06:43:01 -0700, anybody43@hotmail.com (AnyBody43)
> wrote:
>
> >"Buzz Lightbeer" <buzz.lightbeer@spam.dsl.pipex.com> wrote in message
news:<40a3c031$0$20514$cc9e4d1f@news-text.dial.pipex.com>...
> >> "Fred Marshall" <fmarshallx@remove_the_x.acm.org> wrote in message
> >> news:EfednSTzpaeB6T7dRVn_iw@centurytel.net...
> >> > Can anyone suggest software, esp. freeware, that will monitor a
network in
> >> > some limited way?
> >> > Or is there a better newsgroup for this question?
> >> >
> >> > I have one simple task right now. I need to identify unlabeled
ethernet
> >> > cables - with their associated computer IP addresses. Here's the
> >> conceptual
> >> > approach I have in mind:
> >> >
> >> > Plug a sniffer computer into a switch or hub.
> >> > (I'm unclear whether this will work on a switch....)
> >> > Repeatedly Ping all of the computers on the network - using a list or
> >> setup
> >> > of IP addresses.
> >> > Unplug one of the cables.
> >> > Have the missing computer(s) IP address identified (because the Ping
> >> fails)
> >> > Then I can figure out which cable is which.
> >> >
> >> > Or, is there a better way?
> >> > It seems like this would be a common task.....
> >> >
> >> > I'd like to be able to modify the IP list pretty readily. A text
editor
> >> on
> >> > a list or lists would be acceptable.
> >> >
> >> > Thanks,
> >> >
> >> > Fred
> >> >
> >> >
> >> Why not interrogate the switch for it's mac-address-table then relate
the
> >> mac addresses to IP addresses?
> >
> >From: chris@nospam.com (chris@nospam.com)
> >Subject: Re: Get MAC-Address Table from Cisco router
> >Newsgroups: comp.dcom.sys.cisco
> >Date: 2004-05-18 22:14:40 PST
> >
> >Says:
> >
> >Do a search on cammer.pl. It's a perl script that queries a Cisco
> >switch and dumps a list of mac-address, port number, and IP (if you
> >also tell it a router that would have an arp table).

Well, you guys know better than I. That's why I'm asking the question here.
I have a lot of clients in very small offices with very basic switches and
routers. There are no Cisco routers or switches - just Linksys for the most
part.
Further, without being able to extract the translation tables, I don't want
to mess around with mac addresses because it's just another semi-manual
translation layer for me to deal with - an unecessary one in virtually every
situation.

Maybe I'm missing something. I didn't see an answer that suggested how to
identify unlabeled cables at the switch. Having a table of all
possibilities doesn't seem to do that unless I'd disconnect a cable, get a
new list, compare lists. Seems an unlikely path.

I guess I could write a better script than the one I have. Well, at least
it works but demands too much concentration and note-taking.
Presently the script just pings all the known IP addresses and the missing
ones become apparent as long as you keep your eye on the screen.

What I would do is write a better script that will interpret the ping
results and display the missing clients only - or a list of those existing
and of those missing in reference to a master list. I was hoping to find
something like that already written beacause script writing isn't something
I often do.

Fred

Archived from groups: comp.dcom.lans.ethernet (More info?)

"Fred Marshall" <fmarshallx@remove_the_x.acm.org> wrote

> > >Do a search on cammer.pl. It's a perl script that queries a Cisco
> > >switch and dumps a list of mac-address, port number, and IP (if you
> > >also tell it a router that would have an arp table).
>
> Well, you guys know better than I. That's why I'm asking the question here.
> I have a lot of clients in very small offices with very basic switches and
> routers. There are no Cisco routers or switches - just Linksys for the most
> part.
> Further, without being able to extract the translation tables, I don't want
> to mess around with mac addresses because it's just another semi-manual
> translation layer for me to deal with - an unecessary one in virtually every
> situation.
>
> Maybe I'm missing something. I didn't see an answer that suggested how to
> identify unlabeled cables at the switch. Having a table of all
> possibilities doesn't seem to do that unless I'd disconnect a cable, get a
> new list, compare lists. Seems an unlikely path.
>
> I guess I could write a better script than the one I have. Well, at least
> it works but demands too much concentration and note-taking.
> Presently the script just pings all the known IP addresses and the missing
> ones become apparent as long as you keep your eye on the screen.

There are MANY IP scanners on the web. Some free some not. I like
superscan IP.
http://www.pcsupport.dk/index.htm? [...] rscan.html

> What I would do is write a better script that will interpret the ping
> results and display the missing clients only - or a list of those existing
> and of those missing in reference to a master list. I was hoping to find
> something like that already written beacause script writing isn't something
> I often do.


Here is the info that is available from the network.

1.
All switches maintain a list of MAC adresses and the associated port.
This list MAY or may not be available via a console/telnet interface
or SNMP. In the case of Cisco kit it is available from either.
Manageable switches can usually be given a name.
If you have "very basic" switches then there is a good chance that
the information is not available.

2.
End stations (PCs, servers, printers ...etc) and Routers maintain
a list of IP address to MAC address mappings for all the end
stations that they have recently talked to. This is known as the
ARP cache. If you did an IP scan of your whole network from a single
device then that devices ARP cache would become populated
with the IP address to MAC address mapping for all of your devices.

3.
IP address to station name resolution tools exist in end stations.
DNS, Netbios whatever.

4.
Logged in user to logged in PC mapping is available on
Windows servers. "net session"

5.
The ipconfig /all command shows hostname, IPaddress, MAC address
for a single computer. You can also find the user name from the
command line too. Your login script could send this all to
a central location.


This lot would in principle allow you to find the switch name
and port number for any user or any IP address.


I once worked for a company that wrote their own in perl.

Cisco did a tool that did the port-> IP address bit.
It came with CWSI Cisco Works for Switched Internetworks.
Maybe it is still available?


In my experience very few people take network management seriously
and so such tools are in limited availability.


Also my notes say:
User tracking using CAM tables and ARP tables.
have a look at
http://www.cc-lan.fhg.de and then TIRITH
GERMAN ONLY.

Archived from groups: comp.dcom.lans.ethernet (More info?)

<William P.N. Smith> wrote in message
news:8bjbb0doj34i5qlta239gfjpraj14h63vp@4ax.com...
> "Fred Marshall" <fmarshallx@remove_the_x.acm.org> wrote:
> >I have one simple task right now. I need to identify unlabeled ethernet
> >cables
>
> I wonder if one of those hardware tools that blinks the link light on
> the switch wouldn't do the same thing. You might need two people with
> radios, but just plug it into the wall-plate in place of the computer
> and see what lights up....

Thanks for the thought.

There is one person - me. There are no radios. There are no such hardware
tools. I want to plug into a switch or hub or router with my laptop, ping a
known IP list to see that all are there, remove one cable and see what went
away. I have written primitive scripts to do this - they work fine but
could be a lot better in the user interface. Figured someone would have
done something a bit more sophisticated.

Fred