ashberg.de - macsearch

macsearch-0.3

Macsearch is a quick hack written in plain C which queries using SNMP your L2 and/or L3 switches for on which port the specified MAC-address is known.

It has been tested with several Cisco IOS and CatOS switches, Nortel BayStack, Nortel Passport and exttreme networks.
The switches to be queried can be setup in a configuration file (macsearch.conf).

Example macsearch.conf:

passport.company.org public 1,11,12,13,192,213 # VLANs to be queried have to be specified
baystack.company.org public
cisco.company.org public@ 1,11,12,13,192,213 # the "@" and VLANs are neccessary for some Cisco switches

macsearch.conf is searched on different locations:
* same folder as macsearch(.exe) binary
* current working directory
* $HOME/.macsearch.conf (Windows: %APPDATA%\macsearch.conf)
* /etc/macsearch.conf (Windows: %windir%\macsearch.conf)

Having a Nortel Passport you can use parameter "-i" for specifying an ip or hostname instead of the MAC! The passport has to be specified first in the configfile.

macsearch help output:

MACSEARCH 0.3
(C) 2005 by Folke Ashberg
Searches on which port on a switch the given MAC is known


  Usage: macsearch [<options>] <MAC> [<host> <community> [vlan[,vlan,...]]

  if community ends with @ then the vlanid's are appended (cisco-catalyst)

  Options:
    -q Quiet
    -d No Host-ID
    -l No Host-Location
    -m No Parse-MAQ
    -s Short mode (-qdlm)
    -i MAC is an ip/hostname. use first host as resolver (has to be Passport)
    -v verbose

macsearch in action:

C:\>macsearch BA-DE-AF-FE-12-34
MACSEARCH 0.3
(C) 2005 by Folke Ashberg
Searches on which port on a switch the given MAC is known

MAC is BA:DE:AF:FE:12:34 / BA-DE-AF-FE-12-34 / 186.222.175.254.18.52

HOST: passport.company.org
ID: Passport-1424T (2.1.4.0)
LOCATION: Munich-Lab
RESULT: 1/26 | RMON Port 26 on Unit 1

HOST: stack-main.company.org
ID: BayStack 460 - 24T - PWR     HW:03       FW:3.0.0.5   SW:v3.5.0.59 ISVN:2
LOCATION: Munich-Lab
RESULT: ifc87 (Slot: 3 Port: 23) | Nortel Networks BayStack 460-24T-PWR - Unit 3 Port 23   | FOLKE (Port-Description)

HOST: switch-server.company.org
ID: Cisco Systems, Inc. WS-C2980G-A|Cisco Catalyst Operating System Software, Version 6.3(5)|Copyright (c) 1995-2002 by Cisco Systems, Inc.
LOCATION: Munich-Lab
RESULT: 3/34 | short wave fiber gigabit ethernet

macsearch depends on net-snmp
A native win32 binary is available, the net-snmp libraries are statically linked, so you only need macsearch.exe and the included mibs-subfolder. It has been compiled with MinGW

Download:
macsearch-0.3 source: macsearch-0.3.tar.gz
macsearch-0.3 win32 binary: macsearch-0.3.zip