SNMPWALK Output – Translating to Human-Readable Format

ciscocisco-catalystmanagementsnmp

I am asking this question which is related to a question I previously asked and was comprehensively answered by @MikePennington. When I asked that question, I intended to know how to poll arp table from a switch, but in his answer, he included mac address tables as well. Out of curiousity, I polled for the mac address tables. I used the command:

 sudo /usr/bin/snmpbulkwalk -v 2c -c public@1 -OXsq 10.0.0.98 .1.3.6.1.2.1.17.4.3.1.2

In Mike`s solution, he had a clear result shown below

[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public@10 -OXsq \
    172.16.1.210 .1.3.6.1.2.1.17.4.3.1.2 
dot1dTpFdbPort[0:6:53:fe:39:e0] 52 
dot1dTpFdbPort[0:1d:a1:cd:53:46] 52 
dot1dTpFdbPort[0:30:1b:bc:a7:d7] 52
 dot1dTpFdbPort[0:80:c8:0:0:0] 52 
dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 52 
dot1dTpFdbPort[80:ee:73:2f:b:40] 52 
[mpenning@tsunami ~]$

This is a clear solution in which you can easily tell the port and Mac Address. However, my own solution comes out in the form of

iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25
iso.3.6.1.2.1.17.4.3.1.2.0.21.23.10.229.224 25
iso.3.6.1.2.1.17.4.3.1.2.28.111.101.71.85.113 25
iso.3.6.1.2.1.17.4.3.1.2.28.111.101.174.157.35 25
iso.3.6.1.2.1.17.4.3.1.2.48.133.169.153.178.62 25
iso.3.6.1.2.1.17.4.3.1.2.60.208.248.182.16.108 25
iso.3.6.1.2.1.17.4.3.1.2.108.240.73.231.208.120 25

I understand that the port number is 25, but do the other numbers represent a MAC address and if so, why are they different from the give solution?

Any Help will be truly appreciated. I am polling a Cisco Catalyst 2960 switch.

Best Answer

my own solution comes out in the form of

iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25

... do the other numbers represent a MAC address and if so, why are they different from the give solution?

First, I apologize for not including this dependency...

The MIB tables you're polling are indexed by a value. In this case, you're polling dot1dTpFdbPort (which shows up as iso.3.6.1.2.1.17.4.3.1.2, if you don't have the BRIDGE-MIB loaded). That OID is indexed by a mac-address. Therefore, 0.20.42.49.139.235 is the mac-address in dotted-decimal format...

To see the results you expect, you need to get the v2 mibs from Cisco's FTP site:

  • mkdir /usr/share/snmp/mibs/cisco (as root)
  • cd /usr/share/snmp/mibs/cisco
  • Copy v2.tar.gz that you just downloaded to /usr/share/snmp/mibs/cisco/v2.tar.gz
  • tar xvfz v2.tar.gz
  • Edit /etc/snmp/snmp.conf and make this the first line in the file: mibdirs +/usr/share/snmp/mibs/cisco

Assumptions:

  • You're using NET-SNMP libraries to poll
  • Your NET-SNMP default MIBs are loaded in /usr/share/snmp/mibs/
  • Your NET-SNMP configuration is in /etc/snmp/snmp.conf
Related Topic