chall32 / LDWin

Link Discovery for Windows
395 stars 51 forks source link

New Cisco Switch and IOS - More info #21

Open gdbz opened 5 years ago

gdbz commented 5 years ago

We've been using LDWin for a long time and it's been great. We've just put some new switches in (Cisco C9300-48P) and the data LDWIN gets isn't the same. Port Identifier and Switch model, they are reporting different fields such as the IOS version on the switch model and our own description field on the Port ID instead of the port interface. However, if we keep running 'get link data' we can occasionally see the correct info under those fields, but the then other fields, like VLAN Identifier are blank. I'm wondering if Cisco have changed/increaed what information they are sending but LDWIN can only read so much of it?

cascadeth commented 5 years ago

Cisco more than likely edited the structure of the CDP packets. If LDWin needs to show the information, it will need to be updated to parse the correct sections of the updated packets. If you're in immediate need, Wireshark can capture the full packet and you can parse it for the information you're looking for.

chall32 commented 5 years ago

OK thanks for the heads up.

I may have access to some 9300 switches over the next couple of months so I'll take a look.

Chris

On Wed, 6 Mar 2019, 01:03 cascadeth, notifications@github.com wrote:

Cisco more than likely edited the structure of the CDP packets. If LDWin needs to show the information, it will need to be updated to parse the correct sections of the updated packets. If you're in immediate need, Wireshark can capture the full packet and you can parse it for the information you're looking for.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/chall32/LDWin/issues/21#issuecomment-469910082, or mute the thread https://github.com/notifications/unsubscribe-auth/ABGubT4E-9X0esdWvHUyAvHriHp4iuzAks5vTwXbgaJpZM4beZy6 .

gdbz commented 5 years ago

I can send a copy of what the switches are sending out if it helps. It appears I’m getting two broadcasts - CDPv2 and LLDP. When we get the LLDP information, there’s a lot of information - it’s all there, just doesn’t show in LDWIN. When we get the CDPv2 version, it formats fine in LDWIN but loses info like VLAN ID

chall32 commented 5 years ago

Yes please. You can get the raw tcpdump output as shown https://github.com/chall32/LDWin/wiki/What-To-Do-If-LDWin-Captures-No-Data

Thanks

On Wed, 6 Mar 2019, 09:22 gdbz, notifications@github.com wrote:

I can send a copy of what the switches are sending out if it helps. It appears I’m getting two broadcasts - CDPv2 and LLDP. When we get the LLDP information, there’s a lot of information - it’s all there, just doesn’t show in LDWIN. When we get the CDPv2 version, it formats fine in LDWIN but loses info like VLAN ID

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/chall32/LDWin/issues/21#issuecomment-470013122, or mute the thread https://github.com/notifications/unsubscribe-auth/ABGubRcoU4ard7N3Ap0rB6LKrOJViYdIks5vT3rHgaJpZM4beZy6 .

gdbz commented 5 years ago

Here are 2 results from the switches...

Run1: tcpdump: listening on Device.. 11:42:12.674557 LLDP, length 461 Chassis ID TLV (1), length 7 Subtype MAC address (4): REDACTEDINFOHERE Port ID TLV (2), length 9 Subtype Interface Name (5): Gi1/0/11 Time to Live TLV (3), length 2: TTL 120s System Name TLV (5), length 24: REDACTEDINFOHERE System Description TLV (6), length 245 Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.9.1, RELEASE SOFTWARE (fc2)\0x0aTechnical Support: http://www.cisco.com/techsupport\0x0aCopyright (c) 1986-2018 by Cisco Systems, Inc.\0x0aCompiled Tue 17-Jul-18 17:00 by mcpre Port Description TLV (4), length 10: MY VLAN NAME System Capabilities TLV (7), length 4 System Capabilities [Bridge, Router] (0x0014) Enabled Capabilities [Bridge] (0x0004) Management Address TLV (8), length 12 Management Address length 5, AFI IPv4 (1): REDACTEDINFOHERE System Port Number Interface Numbering (3): 0 Organization specific TLV (127), length 7: OUI ANSI/TIA (0x0012bb) LLDP-MED Capabilities Subtype (1) Media capabilities [LLDP-MED capabilities, network policy, location identification, extended power via MDI-PSE, Inventory] (0x002f) Device type [network connectivity] (0x04) Organization specific TLV (127), length 19: OUI ANSI/TIA (0x0012bb) Inventory - hardware revision Subtype (5) Hardware revision C9300-48P (X86) Organization specific TLV (127), length 10: OUI ANSI/TIA (0x0012bb) Inventory - software revision Subtype (7) Software revision 16.9.1 Organization specific TLV (127), length 23: OUI ANSI/TIA (0x0012bb) Inventory - manufacturer name Subtype (9) Manufacturer name Cisco Systems, Inc. Organization specific TLV (127), length 13: OUI ANSI/TIA (0x0012bb) Inventory - model name Subtype (10) Model name C9300-48P Organization specific TLV (127), length 8: OUI ANSI/TIA (0x0012bb) Network policy Subtype (2) Application type [voice] (0x01), Flags [Unknown] Vlan id 0, L2 priority 0, DSCP value 0 Organization specific TLV (127), length 8: OUI ANSI/TIA (0x0012bb) Network policy Subtype (2) Application type [voice signaling] (0x02), Flags [Unknown] Vlan id 0, L2 priority 0, DSCP value 0 Organization specific TLV (127), length 7: OUI ANSI/TIA (0x0012bb) Extended power-via-MDI Subtype (4) Power type [PD device], Power source [PSE - primary power source] Power priority [low] (0x03), Power 0.0 Watts Organization specific TLV (127), length 6: OUI Ethernet bridged (0x0080c2) Port VLAN Id Subtype (1) port vlan id (PVID): 10 Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f) MAC/PHY configuration/status Subtype (1) autonegotiation [supported, enabled] (0x03) PMD autoneg capability [10BASE-T hdx, 10BASE-T fdx, 100BASE-TX hdx, 100BASE-TX fdx, 1000BASE-T fdx] (0x6c01) MAU type 1000BASET fdx (0x001e) End TLV (0), length 0 1 packet captured 291 packets received by filter 0 packets dropped by kernel


Run 2


tcpdump: listening on \Device\ 11:45:39.171526 CDPv2, ttl: 180s, checksum: 692 (unverified), length 392 Device-ID (0x01), length: 24 bytes: 'REDACTEDINFOHERE' Version String (0x05), length: 245 bytes: Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.9.1, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2018 by Cisco Systems, Inc. Compiled Tue 17-Jul-18 17:00 by mcpre Platform (0x06), length: 15 bytes: 'cisco C9300-48P' Address (0x02), length: 13 bytes: IPv4 (1) REDACTEDINFOHERE Port-ID (0x03), length: 21 bytes: 'GigabitEthernet1/0/11' Capability (0x04), length: 4 bytes: (0x00000028): L2 Switch, IGMP snooping VTP Management Domain (0x09), length: 0 bytes: '' 1 packet captured 153 packets received by filter 0 packets dropped by kernel

gdbz commented 5 years ago

If i do a 'Save Link data', the save file does have some of the required information in the file, it just doesn't list in the GUI. The Switch port is listed twice, but different info.
For example, this is the save file output

Switch Name: ma:ca:dd:re:ss:he:re Switch Port: Gi1/0/11 Switch Name: my.name.com Switch Model: Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.9.1, RELEASE SOFTWARE (fc2)\0x0aTechnical Support: http://www.cisco.com/techsupport\0x0aCopyright (c) 1986-2018 by Cisco Systems, Inc.\0x0aCompiled Tue 17-Jul-18 17:00 by mcpre

Switch Port: HR DATA Switch IP: 10.0.10.1 VLAN ID: 1

gdbz commented 5 years ago

It looks like when it receives LLDP data, LDWIN writes the SwitchPort in two places on different results, possibly overriding the information. I have created an additional field for port description and variable ResultSwitchPortDesc to match the “Port Description TLV (4)”. I’ve also added Switch OS to cover this section as that is replacing the Model. This seems to work so far, just need to get the Model to match up.

jeanguanda commented 3 years ago

Hey @gdbz could you please share your changes with us?