Managed Switch Port Mapping Tool 2.32 Released

Two releases of the Switch Port Mapper were done quickly on the heels of v2.30 - the reason was to address issues with SQLITE_BUSY messages seen by some users (but never by us). It occurs during a SELECT of one table and using some of the data from that SELECT to do an INSERT into a different table - same database file. By doing a BEGIN IMMEDIATE wrapping the statements, I was able to solve the problem. It didn't used to happen so it must be a change in SQLITE operation.

I also added in a message to tell the user when Ping Sweep is activate but the IP range for Ping Sweep is empty. That's important because if you want to use Ping Sweep to prepopulate arp tables or to get NetBIOS info from a set of target, you had better define the targets. Why is this needed? simple: most people are using the Switch Port Mapper to map Layer 2 switches that don't keep track of IPs, layer 2's keep track of MAC addresses. So you have to get the IPs by retrieving ARP tables and looking for the MAC addresses so you can work backwards and get the IP addresses.

Get Managed Switch Port Mapping Tool v2.32 here:
http://www.SwitchPortMapper.com/

Managed Switch Port Mapping Tool v2.30 released Feb 26, 2014

Release v2.30 makes major changes to the way Ping Sweep operates. It now allows you to specify an IP range or ranges to ping on a per switch basis. This means you can set the range of IPs to match those handled by the switch. You can also now specify the timeout and retries for the ping packets. Responding IPs are queried for their MAC address and the results are placed in our Combined ARP table for use during the mapping process.

There is also a terminology change: previous versions all referred to Switch Configurations which are the combination of a switch and the two optional devices to query for ARP information. Now that term has been changed to Switch Group in order to reduce confusion with Cisco switch configs.

There are several other changes and the SQLite DLL was updated to the latest version 3.8.3.1.

Managed Switch Port Mapping Tool v2.23 (and v2.22) released Jan 20, 2014

These two releases are pretty important and the difference between v2.22 and v2.23 is literally one line of code thanks to an astute observation by a customer. That one line of code prevents a warning message that might appear if you were mapping a Cisco switch (like the customer's Catalyst 4506) where default VLAN 1 is not used but other VLANs are used.

The focus of v2.22 was in two areas:
1. managing the size of the history database. This database is filled with the results of every completed switch mapping. Over time it can get quite large - especially if you are using Switch List mode. So new tools were added in left panel/Review History to allow you to clean the database by date and compact it manually. The size in bytes (and MB or GB) of the history database is also now shown:

 

If you press Delete Results by Date, you can choose to remove data from the history database older than a certain time.

2. The second area was in the command line operation: we added options to do the same things as you see above from the command line.

You can download v2.23 from http://www.SwitchPortMapper.com/download.htm


Here are the complete list of changes in both versions.

2.23 January 20, 2014
-Fixed minor problem where a Warning message ("The switch did not respond with mapping from bridge ports to ifIndex...") might appear on Cisco switches. The switch was mapping correctly and the warning did not need to be shown - it only occurred if VLAN 1 was not used at all.

2.22 January 17, 2014
-Switch List Editor (important fix): corrected problem with the 'move up' control. Previously, it was copying the data from the device 2 field to both the device 2 and device 1 fields as it moved the selection up in the list. This made a switch list mapping not work correctly because the device 1 field may not be in the switch configuration list.
-Command Line: Added new option to compact all databases.
-Command Line: Added new option to delete data older than a user specified number of days from the history database.
-Review and Search Historical Switch Mapping Results: Added box showing current History Database size.
-Review and Search Historical Switch Mapping Results: Added Delete Results by Date button which gives a method of deleting old results from the History Database.
-Review and Search Historical Switch Mapping Results: Added Compact Database button.
-Review and Search Historical Switch Mapping Results: Fixed problem deleting selected results where an SQLite error would occur deleting from the dot1dBasePortIfIndex table.
-Database Maintenance: Compacting function has been extended to include history database.
-Database Maintenance: Warnings have been added if you try to erase the settings, SNMPdevices and switchConfig tables.
-Support mode event recording expanded.
-Corrected SQLite problem recording the switch list name to the support mode database after completing a switch list mapping.
-Web browser message about duplicate hostnames now suppressed using no error messages command line option.
-Improved speed of writing to history database by removing an unused index.
-SNMP Device Settings: Edit box prompts have been added.
-Updated MAC address/Manufacturer database.

How to send SNMP Traps from a Netgear GS724T switch

Getting your Netgear GS724T switch to send SNMP Traps requires several steps beyond the obvious enabling of traps and defining where the traps are being sent to. Here are the steps. This procedure works with Software Version 5.4.2.9 or .10.

Use your web browser to connect to the switch. Enter the password to login. The default password is password

1. Make sure you turn off the Port Authentication settings you may have enabled.

1a. Security\Port Authentication\Advanced\802.1X Configuration: "Disable" all options, then click apply (lower right corner of window).

1b. Security\Port Authentication\Advanced\Port Authentication: Select all ports and set Port Control = "Auto", then click apply.

2. Security\Traffic Control\Port Security\Port Security Configuration: Click Enable, then click apply.

3. Security\Traffic Control\Port Security\Interface Configuration

a. Select all ports
b. Port Security = "Enabled"
c. Max Allowed Dynamically Learned MAC = "600"
d. Max Allowed Statically Locked MAC = "20"
e. Enable Violation Traps = "Yes"
f. Click Apply

4. Enable Trap Flags. System\SNMP\ SNMPv1/v2\Trap Flags: select the trap types you want to be sent, then click apply.

5. Select the trap destination IP addresses. System\SNMP\ SNMPv1/v2\Trap Configuration: Enter the receiver's IP address, version of SNMP, community string and enable, then click Add, then Apply in the lower right corner.

6. Your switch should now be sending traps. You do not have to reboot it.

You can test whether the traps are being sent or not by using Wireshark on the receiving machine and look for SNMP trap packets (use the filters). Disconnect and reconnect an active device on the switch to force it to send link up/down and mac address change traps. You can also review the trap log by going to Monitoring\Logs\Trap Logs:

This was not an intuitive procedure, I will not take credit for it - the procedure came from their Tech Support - but it does work - have fun with it!

Duplicate IP Address Scanning

Duplicate IP addresses sometimes occur on an IPv4 network subnet if a device is added that already has a static IP address assigned to it. Operating systems like Windows can detect this, but this detection normally happens when the OS is starting up. If a duplicate occurs, ARP reply packets return to a sender (who send ARP discovery) from two sources, both with the same IP but with different MAC addresses. We have a tool in NetScanTools Pro that can scan your whole subnet and look for duplicate IP responses. It will show the MAC address, Interface Manufacturer and Hostname of the duplicate devices.

Here is an example of what happens when a duplicate is found:

Demonstration Video:



This tool is quick and easy to use, you simply enter the IP address range, select the WinPcap compatible interface that is found in the IP address range and start it. If you have a large range like a 10.x.x.x, it may take a long time to complete and I would suggest breaking the range up into ranges where you know devices exist.

To learn more about the Duplicate IP Address Scanner tool and to download a demo with this tool fully active, please visit this page NetScanTools.com

TIP: Managed Switch Port Mapping Tool Update Check

The Managed Switch Port Mapping Tool has a method for checking for updates that simply grabs a small file from our website, then checks the running version against what the file indicates is the latest version. That works fine for interactive (manual) mode, but if you are using the software from the command line on a scheduled basis, it would be better if you turned off the version check.

How to turn the version check on or off:

1. Start the Managed Switch Port Mapping Tool and press the Global Settings button on the left panel. See the screenshot from v2.21 below.
2. 'Uncheck' the box labeled Enable Internet Software Version Check.

If you do turn it off, you might consider signing up for our new version notification email by clicking on Help/New Release Notification Signup or manually checking for a new version once a month by clicking on Help/Check for Update. Otherwise you may be stuck with an old version for a long, long time.

Managed Switch Port Mapping Tool v2.21 released December 20, 2013

This is an important release - especially if you rely on the history database (history.db3) for anything. There was a problem writing multirow mac address, IP address, hostname and interface manufacturer cells (ports with several devices attached to them, like other switches) to the history database. This has been corrected along with several other minor changes. I also move to address an issue with SQLITE_BUSY message handling, so if you are on a slow computer with a slow hard drive, it should work better for you.

You can download this release from http://www.SwitchPortMapper.com/ or from NetScanTools.com. We've also recently added an FTP link for those of you with a strange problem downloading using older versions of Internet Explorer. FTP seems to work, while HTTP on old IE sometimes results in a corrupted zip file. I have no idea why that's happening because the problem shows up for those people no matter which site they download from. Strange.

This release has been fully tested on Windows 8.1, 7 and XP. Other operating systems newer than XP should work fine.

Here is the list of detailed changes:
-Corrected problem saving multirow cells (ports with 2 or more attached mac addresses) to the history database. This affects MAC Address, IP Address, Hostname and Interface Manufacturer columns.
-Changes to SQLite interface to better handle the rare occurrence of SQLITE_BUSY messages.
-Improved retrieval of serial number, model number and software versions from Netgear switches.
-Added analysis of used/unused Gigabit Ethernet (type 117) ports on a switch.
-Added new table to history database saving the dot1dBasePortIfIndex for future use.
-Added checkboxes to control the visibility of the auth and priv passwords in the SNMPv3 settings window.
-Added warning to SNMPv3 settings window regarding AuthPriv mode when the database is unprotected.
-Improved SNMPManager utility to better check versions of libeay32.dll.
-Updated SQLite to version 3.8.2
-Updated MAC address/Manufacturer database.