How to collect list of MAC addresses from Cisco Switch via SNMP (dot1dTpFdbEntry)
How to collect list of MAC addresses from Cisco Switch via SNMP (dot1dTpFdbEntry)
One of the ways to get list of MAC addresses from the forwarding table of Cisco switch is via SNMP MIB: dot1dTpFdbEntry
This MIB branch contain three OIDs:
1.3.6.1.2.1.17.4.3.1.1 (dot1dTpFdbAddress)
1.3.6.1.2.1.17.4.3.1.2 (dot1dTpFdbPort)
1.3.6.1.2.1.17.4.3.1.3 (dot1dTpFdbStatus)
1.3.6.1.2.1.17.4.3.1.1 (dot1dTpFdbAddress) contain list of MAC addresses in Binary format
1.3.6.1.2.1.17.4.3.1.2 (dot1dTpFdbPort) contain IfIndex value of the interface associated with each MAC Address
1.3.6.1.2.1.17.4.3.1.3 (dot1dTpFdbStatus) contain Status code which gives information how each MAC was learned by the switch.
To get list of MAC address perform SNMP Get-Bulk request for “.1.3.6.1.2.1.17.4.3.1.1”
Here is the Example of output from our LAB Switch:
‘1.3.6.1.2.1.17.4.3.1.1.0.21.198.146.146.151’ => “Æ”
‘1.3.6.1.2.1.17.4.3.1.1.0.25.185.178.231.213’ => “¹²çÕ”
‘1.3.6.1.2.1.17.4.3.1.1.0.33.216.202.216.128’ => “!ØÊØ”
‘1.3.6.1.2.1.17.4.3.1.1.0.34.144.251.146.97’ => “”ûa”
‘1.3.6.1.2.1.17.4.3.1.1.0.80.86.156.43.191’ => “PV+¿”
‘1.3.6.1.2.1.17.4.3.1.1.0.80.86.156.49.102’ => “PV1f”
‘1.3.6.1.2.1.17.4.3.1.1.0.80.86.156.69.113’ => “PVEq”
Notice that actual MAC Addresses returned look like some garbage characters but those are actually MAC address in ASCII format that needs to be converted to HEX to get a conventional xx:xx:xx:xx:xx:xx style.
Lets take last line: ‘1.3.6.1.2.1.17.4.3.1.1.[0.80.86.156.69.113]’ => “PVEq”
If we take ASCII text (PVEq) and convert to HEX, we will get 50:56:9C:45:71
If we take Decimal [0.80.86.156.69.113] and convert to HEX, we will get 0:50:56:9C:45:71
So we have a MAC address on both sides.
To get list of associated Ports for each MAC address perform SNMP Get-Bulk request for “.1.3.6.1.2.1.17.4.3.1.2”
Here is the Example of output from our LAB Switch:
‘1.3.6.1.2.1.17.4.3.1.2.0.21.198.146.146.151’ => “2”
‘1.3.6.1.2.1.17.4.3.1.2.0.25.185.178.231.213’ => “2”
‘1.3.6.1.2.1.17.4.3.1.2.0.33.216.202.216.128’ => “1”
‘1.3.6.1.2.1.17.4.3.1.2.0.34.144.251.146.97’ => “1”
‘1.3.6.1.2.1.17.4.3.1.2.0.80.86.156.43.191’ => “2”
‘1.3.6.1.2.1.17.4.3.1.2.0.80.86.156.49.102’ => “2”
‘1.3.6.1.2.1.17.4.3.1.2.0.80.86.156.69.113’ => “2”
Values returned represent IfIndex values for corresponding Interfaces associated with each MAC Address. You need to use [ID substring] to match ifIndex value to MAC Address.
And finally, to get a Status code to each MAC address perform SNMP Get-Bulk Request for 1.3.6.1.2.1.17.4.3.1.3
Example of output from our LAB Switch:
‘1.3.6.1.2.1.17.4.3.1.3.0.21.198.146.146.151’ => “3”
‘1.3.6.1.2.1.17.4.3.1.3.0.25.185.178.231.213’ => “3”
‘1.3.6.1.2.1.17.4.3.1.3.0.33.216.202.216.128’ => “3”
‘1.3.6.1.2.1.17.4.3.1.3.0.34.144.251.146.97’ => “3”
‘1.3.6.1.2.1.17.4.3.1.3.0.80.86.156.43.191’ => “3”
‘1.3.6.1.2.1.17.4.3.1.3.0.80.86.156.49.102’ => “3”
‘1.3.6.1.2.1.17.4.3.1.3.0.80.86.156.69.113’ => “3”
Possible Values codes are
1 = Other
None of the following. This would include the case where some other MIB object (not the corresponding instance of dot1dTpFdbPort, nor an entry in the dot1dStaticTable)
is being used to determine if and how frames addressed to the value of the corresponding instance of dot1dTpFdbAddress are being forwarded.
2 = Invalid
This entry is no longer valid (e.g., it was learned but has since aged out), but has not yet been flushed from the table.
3 = Learned
The value of the corresponding instance of dot1dTpFdbPort was learned and is being used.
4 = Self
The value of the corresponding instance of dot1dTpFdbAddress represents one of the bridge’s addresses.
The corresponding instance of dot1dTpFdbPort indicates which of the bridge’s ports have this address.
5 = Mgmt
The value of the corresponding instance of dot1dTpFdbAddress is also the value of an existing instance of dot1dStaticAddress.
Important Note: This process may need to be adjusted if “per-VLAN” SNMP Contexts being used. In that case you must repeat this process separately for each VLAN by adding “@n” to SNMP community string where “n” is the VLAN ID.