NeDi. Network Discovery that Really Works. Dr. Michael Schwartzkopff. more than software

Transcription

1 NeDi Network Discovery that Really Works Dr. Michael Schwartzkopff

2 Intoduction Member of the new SYS4 Inc. My focus: High Availability, Network Management, IT Security Some other partners: Joerg Heidrich, Ralf Hildebrandt, Florian Kirstein, Dieter Klünter, Patrick Koetter, Marc Schiffbauer, Wolfgang Stief, Christoph Wegener SYS4 is your full service IT partner.

3 Do you know your net? Really? All devices and nodes? Now? Scanning does not make sense in large nets. It is complete useless with IPv6. NeDi asks some seed devices for known neighbours. It adds these devices to the internal TODO list. NeDi crawles recursively through the net to find all devices. NeDi uses SNMP to ask for known neighbours: CDP, LLDP ARP cache, routing table

4 Simple Installation and Configuration Unpack the archive in an appropriate directory. Add the SNMP credentials to nedi.conf Add the database access to nedi.conf Configure your webserver. Run nedi: # nedi -p Go to the NeDi website and take a look!

5 After one run NeDi knows all about your network It can print a map of your net: Topology Map

6 Add Filters to See the Details You can add filters to get the details:

7 NeDi Collects More Data Crawling the network NeDi collects more data than just neighbourhood: Devices: Name, IP, OS, Version, CPU Load, Temp, Memory, Interfaces: Name, Alias, Descr, Statistics, Modules: Model, Serial Number, Slot, Networks: Name, Interface, IP, Mask, Nodes: Name, IP, MAC, VLAN, The webinterface offers reports on all collected data: What port is node NODE1 attached to? How many ports are available on switch SWITCH01?

8 NeDis Database NeDi database design is very simple. It is optimized for speed during discovery, not to avoid redundancy of information (normal form). You can see the database structure from System Export There you also can enter SQL queries to export data sets. Of course you also can use the DB CLI.

9 Asset Management NeDi is perferct for your asset management. It tells you what really exists in your network. You can use this information to check your asset management system. Are all existing devices listed in your asset management system? Do all listed devices exist in real life? You can detect alien equipment, nodes, or networks. NeDi can be used as a security tool also!

10 Reporting Report Type Distribution Possible with all information like software distribution,...

11 Events NeDi recognizes events in the network. Events may be new devices, modules, or nodes. NeDi classifies events according to Level: Other, Info, Notice, Warning, Alert, Emergency Class: Traffic, Config, Discover, Device, Security, User, Monitoring, Node The administrator can configure NeDi to notify about specific events. You also can print reports with specific filters. It is very easy to find out when a module from a specific device was replaced or When a specific node appeared on the net.

12 Sample Event

13 RRDs for Historic Data NeDi stored all historic data of interest in RRDs. Network totals: Number of Events, Nodes, PoE, and Interface Summary Device statistics: CPU, Temp, Memory, and MemIO Interface statistics: Traffic, Errors, Discards, and Broadcasts

14 Graphs Show the Errors

15 Topology The routing tool shows you the actual routes through your net. Reads the routing table via SNMP and determins the next hop recursively. Spanning Tree Table What is the root bridge? What are the costs? Which port is forwarding which one is blocking? Link editor if NeDi did not discover properly. Location editor for geographical locations NeDi evaluates the syslocation OID

16 New Device Classes NeDi classifies devices according to their sysobjectid ( ) If NeDi does not know a specific class, you can define it with the Device Definition Generator: NeDi asks as lot of OIDs and saves them in a definition file. Definition files are plain text files. Of course you can change existing definitions if you want to improve it. Share definitions with the community!

17 Monitoring NeDi can be used to feed the configuration of a monitoring system. But NeDi can also monitor devices. It checks some paramters continously and sends alerts. Like we had with events before. NeDi is not comparable to a really good monitoring system like Zabbix or OpenNMS.

18 Configuration Management If you give NeDi read access to the command line of the devices it can store the configuration every time it discovers it. This feature makes NeDi a nice backup tool. Have a look to rancid which has some additional features. Automatic compare. Versioning. But NeDi is perfect configuring rancid.

19 Write Configurations If you give NeDi write access to your devices it can write commands to devices you select. Execute / Configuration i.e. change ACLs on many devices Inferface Configuration Change interface parameters on many devices Switch down a port. Device selection based on many conditions.

20 Discovery Up to now: Discovery on Logical Link Control (LLC) Layer CDP, LLDP, FDP Discovery of network devices But you also discover everything using the ARP Cache of devices. It is fun to run NeDi with the community string public using the ARP cache! Or you can use the routing table to discover the neighbours.

21 NeDi It Works! NeDi can help you to really understand what happens in your network. Crawling the net is really fast. Never the less there is room to optimize the discovery in your net. It maps your net and stores all assets into a database. The webui gives you full access to all information.

22 Thank you very much for your attention! Questions? Contact: Michael Schwartzkopff