* Legacy Documentation for Statseeker v5.6.0 *

Index


Overview

Statseeker collects and stores MAC-IP relationship data for your network. This data includes the device and interface the MAC was connected to, the VLAN it appeared on, and the ARP table the information was retrieved from. Together, this information enables you to uniquely identify transient infrastructure as it appears on your network and track the movement of mobile hardware within your network.

Statseeker v5.5.4 featured a reworking of Statseeker's MAC-IP module resulting in:

  • Updated dashboard
  • New MAC-IP reports
  • Additional tunable MAC-IP settings providing greater control over MAC-IP data retention
  • New MAC record API endpoints

The legacy MAC-IP-Switchport package is still available (as of Statseeker v5.5.4), but only collects a subset of the data available from the new package, and only stores the data for 7 days.

[top]

MAC-IP Reports

As of Statseeker v5.5.4, there are two new default MAC-IP data reports available, the MAC-IP-Switch Port and MAC reports. These reports are located in the General section of the report list.

General: MAC-IP-Switch Port

The MAC-IP-Switch Port report collects and presents the switch port tables for your network. The report offers drilldowns to the Summary Reports > Device Viewer (Device, MAC Device, and ARP Device), Interface Statistics report (Interface, MAC Interface), and views of the MAC-IP-Switch Port data filtered by the selected VLAN, MAC or IP.

General: MAC Report

The MAC Report collects and presents MAC data for devices seen on your network. The report offers drilldowns to the Summary Reports > Device Viewer, Interface Statistics report, and views of the MAC-IP-Switch Port data filtered by the selected MAC or Date (First/Last Seen).

  • Selecting a MAC record will launch the MAC-IP-Switch Port report, filtered by that MAC, presenting records of where and when the MAC has been seen on the network
  • Selecting a Date will launch the MAC-IP-Switch Port report, filtered by that date, presenting records of which MACs were seen on the network on that date

The legacy MAC-IP-Switchport data and reporting package is still available as of Statseeker v5.5.4 and provides a separate report: MAC-IP-Switch Port (Legacy). This report contains a subset of the data available form the newer reports and there is no ability to store, or report on, that data outside of the previous 7 days. This same data is also available from within any legacy Interface data drilldown report, where it is presented filtered to the specific interface.


[top]

MAC-IP Dashboard

Statseeker's default MAC-IP Switchport dashboard provides an overview of the network's MAC/IP/Switchport configuration with breakdowns by VLAN, device, interface, and ARP Router. The dashboard offers drilldowns to the Device Overview for both the ARP Router and the device associated with the MAC, the Interface Overview, and MAC-IP tables filtered by MAC or IP address.

The default dashboard can be customized as needed (see Working with Dashboards for details) and new dashboard content can be produced by referencing the MAC-IP associated Objects in your dashboard panel configurations:

  • MAC > MAC Records - details of MACs (including dates of first encounter and last seen) seen on your network
  • MAC/IP/switch Port > MAC/IP/switch Port Records - records of where MACs have been seen on your network within a defined date range

For instructions and examples surrounding every aspect of developing dashboard content, refer to the Dashboards specific documentation and videos.

[top]

MAC-IP Settings

There are range of MAC-IP related settings available in the Admin Tool.

Data Retention Settings:

  • Select Admin Tool > Network Discovery - Advanced Options > Advanced Options
  • Scroll to the bottom and click File Edit Mode
  • nim_calc_mis_agetime number of seconds to store MAC records, default value is 7-days (604800 seconds)
Note: this setting does not apply to data collected via the legacy MAC-IP-Switchport package, data collected via the legacy package can only be stored for 7 days.


Statseeker also provides the option to purge all existing MAC-IP records, following this Statseeker will begin to repopulate the MAC-IP tables from fresh data. This option can be accessed by:

  • Selecting Admin Tool > Statseeker Administration > Services
  • Click Edit (top-right)
  • Locate the MAC-IP Reset option and click Run
  • Read the Warning notice presented and confirm the action to proceed
Note: the MAC-IP Reset process may take up to an hour to complete when purging a large number of MAC entries. Please ensure that a discovery/rewalk is not initiated while the MAC-IP Reset process is running.


Report Display Settings (only apply to the Legacy MAC-IP-Switchport package):

  • Select Admin Tool > Network Discovery - Advanced Options > Advanced Options
  • Scroll down to the Reports section
    • MAC/IP Switch Port report - toggle the availability of the legacy MAC-IP table in all Interface Drilldown reports
    • Nim Console \ Device Viewer \ Interface Drilldown - Expanded view mode - the expanded view mode only applies to the legacy MAC-IP-Switchport reports. The legacy mode stores MIS records for all Statseeker known interfaces, even if there has been no MAC seen residing off it. The Extended view mode includes these records in the report/table.
    • Interface Drilldown - Display table - display options when the legacy MAC-IP table is presented in an interface details drilldown report
      • none - the data is not displayed in the report
      • always - the data is always displayed, but may take a moment to populate when a large number of records would be displayed
      • hide - data display can be toggled from within the report, hidden by default
      • show - data display can be toggled from within the report, shown by default
      • embed - the data is always displayed


[top]

Retrieving Data from SNMPv3 Devices

Statseeker will manage MAC/IP data collection from devices via SNMPv2 seamlessly but when accessing VLAN data from the BRIDGE MIB via SNMPv3, each VLAN needs to be assigned to an SNMPv3 context. This configuration is made on the device itself and must be applied to every VLAN that you want Statseeker to monitor for MAC/IP records.

To determine if your switch supports contexts, and to identify the VLAN's available on the device, use the following command on the device CLI:

enable
show snmp context

If the output returns a list of VLANs, then Statseeker will be able to retrieve MAC/IP data via SNMPv3 once the VLANs have been configured to do return this data.

Configuring a Single VLAN

For each VLAN to be monitored on a device, apply the following configuration via the CLI:

  • snmp-server group <GROUP_NAME> v3 priv context vlan-<VLAN_ID>
  • Example: 
    enable
config term
snmp-server group MyGroup v3 priv context vlan-4
snmp-server group MyGroup v3 priv context vlan-5
snmp-server group MyGroup v3 priv context vlan-12

Configuring Multiple VLANs

This method works for recent OS versions (does not work on devices running IOS v12.4(20)T or earlier) and will apply the setting to all VLANs on the device.

To configure all VLANs on a device, apply the following configuration via the CLI:

  • snmp-server group <GROUP_NAME> v3 auth context vlan- match prefix
  • Example: 
    enable
config term
snmp-server group MyGroup v3 auth context vlan- match prefix

[top]

MAC API Endpoints

API v2.1 r12 contained a reworking of the MAC related endpoints, deprecating the cdt_mis endpoint from earlier versions and replacing it with the mac and mis_record resource-level endpoints.

Note: any script referencing the cdt_mis endpoint needs to be updated, as support for this endpoint will be removed in a future release.


MAC Records (mac)
Field ID Field Title Type Get, Add, Update Description
portid Interface ID integer G, A, U The port on the device the MAC address belongs to (if known)
firstseen First Seen time G, A, U The first time MIS collector saw this MAC
deviceid Device ID integer G, U The Device the MAC address belongs to (if known)
oui Vendor string G, A, U The Vendor associated to MAC
name MAC string G, A (required), U The MAC represented as a string
id ID integer G, A, U MAC Identifier
lastseen Last Seen time G, A, U The last time MIS collector saw this MAC
lastmisrec Last MIS Record time G, A, U The last time MIS collector added a record for this MAC
Links

This resource has links to the following:


MAC/IP/Switch Port Records (mis_record)
Field ID Field Title Type Get, Add, Update Description
vlan_id VLAN Id integer G, A VLAN ID on port which MAC address was seen
id ID integer G Record Identifier
time Time time G, A (required) The time when the MIS record was inserted
connected_port Connected Interface integer G, A Interface ID of port MAC was seen on
connected_device Connected Device integer G, A Device ID MAC was seen on
ip IP Address string G, A The IP Address of the End Device
name MAC string G, A (required) MAC Address
vlan_name VLAN Name string G, A VLAN Name on port which MAC address was seen
arp_router ARP Device integer G, A The device whose ARP cache the MAC address was retrieved from
Links

This resource has links to the following:

[top]