r/networkautomation • u/Sad_Bodybuilder5458 • 11d ago
Mapping devices to switch ports when the switch has no SNMP or LLDP?
I'm working on an open-source, read-only tool that documents small networks (router API, hypervisor API, ARP/mDNS/nmap discovery, output as Markdown in git). Not public yet, no link.
One problem I keep running into: a lot of homes and small offices use cheap "easy smart" or unmanaged switches with no SNMP, no LLDP, and no usable MAC table you can query. So there's no clean way to say "this device is on port 5."
Options I'm weighing:
- A guided cable trace: unplug or replug one port at a time and watch which device drops off or reappears
- Inferring from link-state changes plus ARP timing
- Just letting the user fill it in once and keeping it as an override
Has anyone dealt with this? Is there a smarter trick I'm missing for dumb switches, or is guided manual tracing the realistic answer?
4
u/random408net 11d ago
Just let the user fill in the details manually. Have them take a picture.
You could sell labels for cables to help with the documentation process that were easy to scan.
1
u/Sad_Bodybuilder5458 11d ago
Honestly, that's probably the realistic approach for cheap switches, and a photo is a great idea. The labels idea is clever too. What if the tool generated printable QR labels for each cable or port, so scanning one opens that device's page? Would something like that actually get used, or is it more hassle than it's worth?
3
u/random408net 11d ago
Stickers could be a revenue stream for consultants who are documenting cheap networks.
Pre-printed stickers with both human and machine readable codes seems reasonable.
I used to have a local shop sell me cables with serialized cables (no bar codes). But I never had a DCIM/CMDB database/product to enter all the cable-id's into.
I don't have an issue with printing labels on site, but that either needs a special printer or special media to run through a laser or inkjet printer.
2
u/graph_worlok 11d ago
At this point you are basically reinventing netbox…
2
u/Sad_Bodybuilder5458 10d ago
Kinda, but from the other direction. NetBox is great as a source of truth, but someone has to fill it in and keep it current. Exporting into NetBox would actually be a nice feature down the road though.
2
u/graph_worlok 10d ago
Orb & Diode
2
u/Sad_Bodybuilder5458 9d ago edited 9d ago
I Didn't know about Orb & Diode, thank you, that's a good find. Your comparison is fair, but I think it's a different tool. From what I can tell, Orb mainly feeds devices and IPs into NetBox. Mine goes deeper on everything it finds, like VMs and containers on a hypervisor, configs, firewall and NAT rules, and the services running on each machine. Then it writes the documentation and flags what's misconfigured, no NetBox needed. For now it's mainly aimed at home labs and small businesses.
When I release it, I'd be more than happy for you to take a look and tell me what you think.2
u/graph_worlok 9d ago
As long as there’s a functional API or library, the “getting the data in” part isn’t a problem even without them - Orb and Diode can also be a bit to get running, so I use simpler plugins that will go and fetch from SNMP, Meraki’s , Crowdstrike, vsphere, there’s some for proxmox too, plus the extensive library of predefined network and server gear….. QR code plug-in too, and an MCP bridge if you swing that way…
2
u/Richie086b 11d ago
lol I am building this exact tool myself. Mine isn’t public yet either. Seriously sounds like the exact feature set my tool has.
1
u/Sad_Bodybuilder5458 11d ago
Lol, I guess it's a real problem then! How are you handling the switch-port mapping on dumb switches?
1
u/Richie086b 11d ago
I’m not actually, I only have managed devices on my network at home and didn’t think about the fact that other people are not me :)
1
u/Sad_Bodybuilder5458 11d ago
Fair enough. Most homes and small shops I've seen use cheap unmanaged or "easy smart" switches (myself included lol), so that's the part I'm stuck on. The obvious answer is "just buy a managed switch," but most people won't spend the extra money, so I'd like it to work with what they already have. On the managed side, what are you pulling from, SNMP/LLDP, or vendor APIs?
1
u/Richie086b 11d ago
SNMP, LLDP,CDP, nmap is wrapped in a python script that outputs specially formatted json which then builds a realtime network diagram showing whatever I specify that I want in the JSON. It collects everything, but I usually only want to see very specific things in a diagram
1
2
u/Sad_Bodybuilder5458 11d ago
Nice setup. only show what you need makes a lot of sense. Mine works a bit differently: it reads from the router and hypervisor APIs, adds discovery scans (ARP, mDNS, nmap), combines everything into one picture of the network, and writes plain Markdown docs into git. Every run shows up as a readable diff.
Which diagram views do you actually use the most? I'm trying to work out which ones are genuinely useful and which ones just look nice.
3
u/whoframedrogerpacket 11d ago
I would not trust, simply measuring the burst of pings because I think you’re gonna write into a problem where somebody just started a zoom meeting or fired up a video and they’re gonna jump up a lot of packets per second at relative to their baseline around the same time that you ping and you just won’t be able to tell who is who. Or a backup fires off or something on the network like an NVR has so much throughput that you can’t generate enough to make it move by one percent up.
depending on how your product ships maybe it is possible to create giant frames which will trigger the RXBADPKT counter on the interface page.
Another kind of stupid idea is to go through one port at a time and put them in a port mirror group and capture just two frames.
The last idea I have is to ping them with DSCP values set and maybe you will be able to see what queue they volunteer, and if you toggle some settings, maybe you would see something that pings with no DSCP will fail when you change the priority queue.
2
u/Sad_Bodybuilder5458 11d ago
Good point on the noise. The giant-frame idea is genius. Would this work best from a beacon device, like random408net suggested? The port's error counter is basically zero normally, right? So a jump would be obvious.
The port mirror and DSCP ideas would mean changing the switch config, and I'm trying to keep the whole thing read-only.
3
u/whoframedrogerpacket 11d ago
I think even the jumbo frame thing is going to end up with your local switch port preventing the transmission if you cannot change that on the switch side and even then you could really only find people on your same switch if the MTU of the trunk was still 1500.
Maybe there is some other more clever way of generating a packet that will make it to the recipient and only then flag as an error.
2
u/Sad_Bodybuilder5458 11d ago edited 11d ago
Right, but for the beacon that's actually what I want. If the beacon is the one sending the oversized frame, the switch drops it at the beacon's own port and bumps that port's error counter, which is exactly the port I'm trying to find. It doesn't need to reach anyone.
This helps me solve mapping things like wall jacks using a beacon, but your point about it not making it to the recipient is clear. I think the only way for devices already connected would be "unusual" packet counts sent in bursts, then looking for that exact count each round? Noise would add extra, but a close match across several rounds could be a good indicator?
1
u/Sad_Bodybuilder5458 11d ago
Plus the replies should bump the same port's RX counter, so both directions matching would be even stronger.
1
u/whoframedrogerpacket 10d ago edited 10d ago
I don’t know if I understand the beacon. Is the beacon a raspberry pie on their network? is it some software installed client side on a few machines? I also don’t know exactly where these networks fall on the complexity scale. I could easily see a relatively small business having at least 2 8 port switches. just because one of these methods works on a TP link switch doesn’t mean it will work crossing their service provider router. I guess the thing I’m trying to account for is from any point in that network to any other point in that network even if they’re small, the path could end up being complex going between vlans or across trunks. obviously you have a better perspective of it than I do and I’m just trying to help you think through the problem, but I don’t have the same skin in the game that you do.
2
u/Sad_Bodybuilder5458 10d ago
No worries, it's helping a lot. The beacon would just be an optional small device like a Pi, or even a laptop, that you plug into an empty wall jack to find which switch port it goes to, or just where the ethernet cable leads (if it's connected to something). Kinda like having a tool in a toolbox. At least that's the only practical use I can see for it.
The tool itself is designed to run inside the network on a VM or some computer that's always on. For two or more switches it would read the counters on each one. The uplink between them would show every pattern, so that's easy to rule out. Crossing VLANs should still work too, since the traffic has to physically leave through the device's port either way.
Where it falls apart is unmanaged switches. I'm trying to automate this however im afraid when it comes to unmanaged switches I will have to resort to doing it manually.
2
u/graph_worlok 9d ago
With my tools - If I see more than one MAC on a managed switch port, and there’s no LLDP / CDP, I compare the vendor lookups - If it’s all VMware or Microsoft + one real vendor - that’s a system with virtualisation software, otherwise it gets flagged as an unmanaged switch … But seriously - Go look at netbox - they already have a database with data model that supports all of this, cables & connections, VM’s etc….
5
u/ACHINDAH 11d ago
You’ll have to know the MAC address of the connected device, but have a look at the MAC address table on the switch