DLink DIR-825 and dd-wrt

[siafu_kali]

I have a DLink DR-825 with DD-WRT on it that I am monitoring with Cacti. I just got mactrack running and created the following custom device for it:

Code: Select all

Description: DD-WRT
Vendor: DD-WRT
Device Type: Switch/Router
System Description Match: Linux
Vendor snmp Object ID Match: .1.3.6.1.4.1.8072.3.2.10
MAC Address Scanning Function: get_linux_switch_ports
IP Address Scanning Function: get_standard_arp_table
Serial Number Base OID:
Serial Number Collection Method: SNMP Get
Low User Port Number: 0
High User Port Number: 0

php mactrack_scanner.php -id=1 -d

Code: Select all

DEBUG: HOST: 192.168.1.1 is alive, processing has begun.
DEBUG: Scanning function is 'get_linux_switch_ports'
DEBUG: ifIndexes data collection complete
DEBUG: ifTypes data collection complete.
DEBUG: ifNames data collection complete.
DEBUG: ipAddrTable scanning for link ports data collection complete.
DEBUG: ifInterfaces assembly complete.
INFO: HOST: 192.168.1.1, TYPE: Linux lw-firewall 2.6.24.111 #3404 Sat A, TOTAL INTERFACES: 9, OPER INTERFACES: 7
DEBUG: Port number information collected.
DEBUG: No user ports on this network.
DEBUG: Scanning function is 'get_standard_arp_table'
DEBUG: atifIndexes data collection complete
DEBUG: atPhysAddress data collection complete
DEBUG: atNetAddress data collection complete
DEBUG: atPhysAddress MAC Address Conversion Completed
DEBUG: atEntries assembly complete.
DEBUG: HOST: 192.168.1.1, IP address information collection complete

Mactrack IP Addresses show:

Code: Select all

WRT1	192.168.1.1	192.168.1.10	00:18:xx:xx:xx:xx	Cameo Communications, Inc.	0
WRT1	192.168.1.1	192.168.1.124	00:1F:xx:xx:xx:xx	Apple, Inc.	0
WRT1	192.168.1.1	192.168.2.1	00:12:xx:xx:xx:xx	Cisco-linksys, Llc	0
WRT1	192.168.1.1	192.168.1.129	00:12:xx:xx:xx:xx	Intel Corporate	0

However nothing shows up under IP Ranges, MAC Addresses, or Interfaces, Mac Watch, or Mac Authoriziations. It seems like I'm so close! The connected host IPs and Macs are discovered and show up in IP Ranges, but I'm not getting the full functionality of tracking MAC addresses. Is there something I'm doing wrong or could tweak?

[siafu_kali]

And Sites reports:

Code: Select all

1 Device
3 Total IPs
9 User Ports
7 User Ports Up
0 MACs Found
0 Device Errors

How do I get the 3 MACs associated with the 3 found IPs to show up in the MACs Found list?

[TheWitness]

Likely either a timeout, or the bridgePort information is not being returned. You have to dig a little deeper.

TheWitness

[siafu_kali]

Likely either a timeout, or the bridgePort information is not being returned. You have to dig a little deeper.

TheWitness

I'd be happy to. Would you point me in the direction of where to dig? This is my first experience with mactrack and I'm not sure how it all ties together.

[TheWitness]

Walk the whole tree and post the findings

TheWitness

[siafu_kali]

Here you go. I wasn't sure exactly which branch to walk, so here is the whole tree.

[TheWitness]

As I suspected, the device is missing a key component of the snmp spec that allows mapping of an IP Address to a physical port.

TheWitness

[siafu_kali]

Is it possible to still use mactrack without this piece? I actually don't care about which interface the IP or MAC is associated with, I just care which device it is associated with. For example, mactrack shows me which IPs and MACs are found on the device under the IP Addresses tab, so they are found. However I don't seem to have the ability to "interact" with the information (e.g. nothing shows up under Mac Watch or Mac Authorizations).

Also, is there anyway that I could assign a default port (or force a default port) if one can't be found? For example, all of my clients are wireless clients, so they're coming from the same wireless interface anyway.

[TheWitness]

1) Pretty sure MacTrack will work just fine.
2) What is your motivation behind 'default' port?

TheWitness

[siafu_kali]

1) Pretty sure MacTrack will work just fine.

I guess what I'm trying to say is that it currently isn't working just fine. Information only shows up in the IP Addresses section of Mactrack, but nothing registers under the other sections (IP Ranges, Mac Addresses, Interfaces, Mac Watch, or Mac Authorizations). All of these areas display a variation of "No details found". (e.g. No MacTrack Watched Macs, No authorizations found, No Mactrack ports found, No scanner devices found)

2) What is your motivation behind 'default' port?

My motivation behind a 'default' port is to provide what I'm assuming is the missing information to allow the detected information under the IP Addresses tab (IPs and associated MAC addresses per device) to be made available to the other Mactrack Tabs.