Find and Locate Switches

[just_david]

We've got a bit of a problem in our network. It works, but damned if i know how. The documentation for our switches was never completed by the installer/manager of the time.

 

Everything works, but some of the switches are getting old or need to be upgraded.

But we don't have any IP addresses for about half our switches, and I can't find them anywhere in DNS or DHCP.

I've tried scanning the network but they didn't show up in solarwinds or spiceworks.

If it wasn't for the fact they are there and working I wouldn't know they existed.

 

Its Mostly Netgear kit thats undocumented, Multiple netgear GS748's and GS 724's, a GS7241, gsm 1x 7352 (though thats possibly paired with another to show as one unit), aand a lone cisco catalyst 2950

 

All our HP's I've been able to locate either through documentation or through dhcp

 

They don't even seem to have a way to connect directly too them. Any ideas how to track them down?

[caffrey]

Tried netgear smartwizard discovery ? Vlans ? They could have a management vlan ?

[just_david]

That kind of worked... It found 1 of them ^^

[FN-GM]

Do Netgear have LLDP? If they do and the others have it enabled it should get you the info you need.

[just_david]

Well shit, guess what else isn't logged.

Passwords

Could do a master reset but we have no idea if they have any vlan configurations :/

 

Why did I open this box

[free780]

Find one with the least kit connected. Hope its not part of a stack. Reset and reconfigure. If you don't have the passwords that's your only option.

[just_david]

I think I'm going to try that. I know just the switch its going to be finding the time

[pete]

I'd break out nmap when it's quiet and poke around in your IP ranges, doing 100 at a time with nmap configured to be polite (-T polite) so it doesn't make anything delicate fall over.

 

Those GS 724's may have self-bricked BTW - they'll shift packets but won't respond to management requests./output

[free780]

I'm guessing the switches ip is on a separate subnet to your PCs.

[mikeprice]

I recently found a couple of undocumented access points by using Fing on Android - it gave me a list of IP addresses with the name of the board manufacturer

 

I then compared this with DHCP and just tried connecting to all the IP addresses that weren't in DHCP and not otherwise known (e.g. printers etc with fixed IP addresses)

[MatthewL]

I've used Fing before on my iPad, seems to do quite well.

[just_david]

What do you mean by self brick?

Is this something the model has a tendency to do or an age related issue?

 

I don't think there'd be a subnet issue.

Most of the netgears are plugged into HP's as they were relegated/replaced by HP's when the network was upgraded a few years back.

All the subnetting, anything special is handled by HP's. The netgears were just kept to add capacity

[caffrey]

The interface can just break except the switching still keeps going (I find ours can break if I use the wrong browser... - I recommend an old copy of firefox), can only be fixed by a power cycle.

[paulellam]

Netgear Genie software can find most things

[sted]

be aware iirc some of the older netgears don't have fixed or dhcp ips until you plug a serial cable into them and turn those options on ive had a couple before where ive had to find a way to get a serial cable into a switch that's well and truly wired into a cabinet (and why don't all cabs have removable side panels)

[just_david]

Netgear genie didn't find a thing :/

 

Will all the netgears have serial ports, i couldn't see any on ours.

[CAWJames]

I'd second serial ports or console ports, best way. I have an old XP toughbook with Ubuntu on it. A selection of Cisco, hp and general serial console cables and I can pretty much use minicom on the laptop to enter any switch and have a look. You will probably need passwords for any changes, not sure how Netgear work, and as above if they actually have serial ports!! At least if you can get an IP, you can work out if there is a management vlan.

 

I have had to look up old admins in the past, and offer them beer and/or computer parts to give me passwords!!

[pete]

GSM series Netgear have serial consoles, the lower-end stuff tends (tended? haven't bought any for a long time) to only have a web console.

[Asgard]

Netgear NMS300 might help you discover them and if SNMP is enabled you should be able to at least connect as read only

 

http://support.netgear.com/product/NMS300

[m25man]

Its the collation of LLDP/CDP packets at Layer 2 that enables discovery of network topology.

SNMP doesn't do this, although once setup and configured correctly it can provide additional detailed information to those tools that can utilise it.

 

Switches that do not have LLDP/CDP support (usually cheaper unmanaged units) will only confuse auto-discovery tools such as LanSurveyor or NMS as these devices ARP tables will simply be assumed to be upstream of the last LLDP enabled switch so any misconfigured devices will make mapping a very hit and miss affair.

 

Netgear switches especially with so many variants of the same model (V1,2,3,4) hardware etc can make auto discovery a challenge.

 

If the switch hasn't been correctly set up they can assume a default static IP on a range that may not be on your subnets, hence your discovery issues and if you have VLANs on your Netgears their crazy interpretation of zero config networking on some "Smart" switches only makes it harder to tame.

 

Without the correct tools you are going to continue to chase your own tail.

Wireshark is fine,

a. If you know how to interpret the captured data.

b. Know how to capture correctly in the first place.

 

NetGear kit uses various default IP addresses:-

169.254.100.100 Mask 255.255.0.0 is a favourite commonly used for firmware recovery.

192.168.0.250

192.168.0.239

and several others.

 

If you already have a device on your lan using one of these ip's or you've reset more than one switch, chances are they they are all now probably hiding behind the same IP that's out of your detectable range.

 

You can try putting a pc on the common 192.168.0.x subnet, scan it and see what turns up.

You can isolate the switch completely plug a laptop with Wireshark installed into the switch and wait, with a bit of luck it will start to broadcast and show the mac of the switch and its current IP.

 

Lucky for me, I just plugin one of the many Fluke tools I have at my disposal and a couple of minutes later the jobs done.... without any disruption.

 

Even for the novice, an LRAT2000AT with fibre module and a couple of test leads will have every port on the lan logged, tested and traced in a day.

 

If your stuck with this type of problem, Fluke have a Try & Buy deal on a number of tools at the moment, so why not get a demo unit, fix your problem and send it back when your done [emoji6] who knows, you might even buy one!

 

Give Adam Pearce @ AJP Solutions in West Sussex a call they are very helpful bunch and will let you have some demo kit to play with.

There are several other resellers like RS, Comms Express, CPC etc but I doubt you'll get the same level of assistance as these guys will give you.