NetLay: Making the switches introduce themselves

Why not just use nmap?#

It is the obvious question and I wrote it down myself.

"How about if we added nmap with the server to help us find information?"

nmap would give me version detection, operating system fingerprinting and a scripting engine that already knows how to ask half the questions I am asking by hand. It is a better scanner than anything I am going to write.

I parked it anyway, for three reasons. The good parts on Windows need a packet driver installed, which breaks the promise that this unzips into a folder and runs. Redistributing it brings licence conditions I would have to take seriously. And a proper nmap scan on a corporate network looks exactly like somebody doing a proper nmap scan on a corporate network, which is a conversation with the security team I do not want to have on behalf of a documentation tool.

So instead, four more sources of evidence that need nothing installed at all.

Reading what services already tell you.#

Most things announce themselves if you just connect and listen. An SSH banner saying SSH-2.0-Cisco-... is a switch. A web server header saying HP HTTP Server is a printer. Between the Server: header and the page title you can identify most of the rest.

That is a rules table of needles mapped to device types, first match wins, with the vaguer ones only used when nothing better has turned up. Every guess still carries its reason in a tooltip, same as before.

Three names nobody has to configure.#

NetBIOS on port 137 gives you the Windows machine name and its workgroup or domain, and as a bonus hands over the MAC address even when the device is on another subnet, which ARP cannot do.

mDNS, asked directly at the host rather than shouted at the network, gets answers from phones, Macs and printers.

SSDP is one multicast search followed by fetching each device's description document for the manufacturer and model. That is how the mesh system at home names itself without me typing anything.

Two hints that were already in my hand.#

The ping replies have a time to live in them, and operating systems start it at different values. Around 128 is Windows, around 64 is Linux, 255 is usually network kit. I read it as bands rather than exact numbers because every hop knocks one off.

And the stored traceroutes from post eight already contain routers, by definition, because anything that appeared as an intermediate hop is forwarding traffic for somebody.

The big one.#

Then there is SNMP, properly this time. Given a read only community, the app walks a switch and comes back with the system description, the entity table giving model, serial and software per stack member, the interface table with every port and its admin and operational state, Cisco's VLAN membership and trunk information, the bridge forwarding table per VLAN, CDP and LLDP neighbours, and the ARP cache.

That is everything the pasted show output gives you, without anybody having to paste anything.

I wrote GETBULK by hand to cut down the round trips, with a fallback to GETNEXT for anything that does not support it. Cisco's per VLAN MAC tables still mean one walk per VLAN, so a big switch takes a minute or two and the dialog says so rather than appearing to hang.

The trick that made this cheap was refusing to build a second pipeline. The walk converts its results into exactly the same parsed shape the show output importer already consumes. One refactor, and the SNMP path gets the preview, the apply, the re-import and the whole reality check for nothing.

A read only community is also a much smaller thing to ask for than a set of exports. Nobody has to find time to log into fifteen switches, and the reality check stops being something you run when somebody sends you a file and becomes something you can run whenever you like.

A bug found by using it at home.#

My own core switch came back from discovery as a host that was not on the map, which was annoying, since it is in the middle of the map.

The matching only ever looked at devices, by address or MAC. Switches live in a different table with a management address, and nothing was comparing against that. So a discovered host is now matched against switch management addresses too, linked to the switch, kept out of the not on a map list, and offered a walk instead of a place. Applying an import re-matches immediately afterwards.

That is the kind of bug you only find by using your own tool on your own network, which is the argument for doing that at every opportunity.

And a favicon#

Lastly, and least importantly, the application finally has an icon. Three nodes and two links in the panel colour, an SVG for the browser tab, PNGs rasterised using nothing but the Python standard library because Pillow is not a dependency and I was not about to make it one for this, and a small manifest so it looks right pinned to a phone home screen.

It took an hour, it does nothing, and the app stopped feeling like a project and started feeling like a thing.

Next time, the most annoying green dot there is.

NetLayNetworking