Start a Conversation

Solved!

Go to Solution

Closed

4 Posts

472

May 22nd, 2023 06:00

Dell N4032F: switch providing garbled IPv6 addresses via SNMP when querying IPV6-MIB::ipv6

Hello,

I am trying to log the association between host IPv6 and MAC addresses using SNMP queries on two Dell N4032F L3 switches running the most recent 6.5.4.20 firmware.

When performing an snmpwalk from a Linux workstation (using either SNMP v2c or v3), I get the following results when querying IPV6-MIB::ipv6NetToMediaPhysAddress as an example:

IPV6-MIB::ipv6NetToMediaPhysAddress.946.'..............3.' = STRING: a8:f7:d9:82:33:f2
IPV6-MIB::ipv6NetToMediaPhysAddress.947.' ..|..b........7' = STRING: c:4d:e9:c1:6d:a5
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'..........P...k.' = STRING: 52:66:13:82:eb:c5
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'.........;....h]' = STRING: c:4d:e9:c1:6d:a5
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'...........k/.[.' = STRING: 66:f4:a1:c7:4c:33
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'.........J...l.P' = STRING: 56:f7:cf:bb:64:a4
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'........5....o..' = STRING: 0:d2:b1:bb:ef:6a
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'........9.....'.' = STRING: 5c:d0:6e:e1:a1:5e
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'........L....'..' = STRING: 4e:b:85:27:85:a
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'........P/...f..' = STRING: 52:2f:13:66:17:a
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'........e^j.L...' = STRING: f4:8e:38:d8:1a:a3
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'........|.>...H.' = STRING: 7e:a4:3e:3:48:91
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'..........l4c..%' = STRING: 0:be:43:93:e4:65
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'..............4:' = STRING: b8:ca:3a:94:cb:ba
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'............../.' = STRING: ce:a4:b6:a:2f:c4
IPV6-MIB::ipv6NetToMediaPhysAddress.947.'..........X.|.'.' = STRING: 98:59:7a:4e:b:4c
IPV6-MIB::ipv6NetToMediaPhysAddress.949.'........."..."|P' = STRING: 2:22:f:22:7c:50
IPV6-MIB::ipv6NetToMediaPhysAddress.949.'.........)....Q.' = STRING: fa:97:7:50:a:4f
IPV6-MIB::ipv6NetToMediaPhysAddress.949.'.........c.u4.U-' = STRING: 4a:fd:7b:d7:d4:9
IPV6-MIB::ipv6NetToMediaPhysAddress.949.'........e^j.L...' = STRING: f4:8e:38:d8:1a:a3
IPV6-MIB::ipv6NetToMediaPhysAddress.949.'........iX......' = STRING: b8:85:84:ab:46:e5
IPV6-MIB::ipv6NetToMediaPhysAddress.950.'.........A{.1..e' = STRING: 66:70:b4:f:df:b4
IPV6-MIB::ipv6NetToMediaPhysAddress.950.'.........Vc...z$' = STRING: ea:b2:fe:6c:6d:e3
IPV6-MIB::ipv6NetToMediaPhysAddress.951.'.............Mb.' = STRING: f0:9f:fc:4d:62:14
IPV6-MIB::ipv6NetToMediaPhysAddress.953.'..........].....' = STRING: 0:15:5d:86:99:bb
IPV6-MIB::ipv6NetToMediaPhysAddress.954.'................' = STRING: 0:9:f:9:0:7
IPV6-MIB::ipv6NetToMediaPhysAddress.956.'.............#..' = STRING: 0:5:a6:23:cd:7
IPV6-MIB::ipv6NetToMediaPhysAddress.960.'..........<.....' = STRING: b0:c5:3c:c9:1:c5
IPV6-MIB::ipv6NetToMediaPhysAddress.961.'.............sWE' = STRING: c8:0:84:73:57:45
IPV6-MIB::ipv6NetToMediaPhysAddress.962.'..........-...S.' = STRING: 84:80:2d:e8:53:c5

When querying IPV6-MIB::ipv6NetToMediaNetAddress, I get "No Such Object available on this agent at this OID".

Using the IPv4 equivalents (which are exactly the same but with the "V6" and "v6" removed), I get valid results for IPv4.

Before the  = STRING, the system should be returning IPv6 addresses,  but instead, it returns the garbled mess seen above, with each line showing the "................" (always 16 characters, mostly periods but other characters are sometimes shown).

I have done snmpwalk on the entire OID tree of the switch, and confirmed that no other OIDs available that give the IP addresses of neighbors, even after installing the Dell-specific MIB files.

When connecting to the switch and running show ipv6 neighbors, I have plenty of valid entries that should be showing up.

Is there some reason that the switches are not providing valid addresses that any of you could think of?

Thanks in advance for any advice!

Moderator

 • 

3.7K Posts

May 24th, 2023 05:00

Hello swalker,

 

Could you provide the results of running the snmpwalk command using the "-On" modifier to fully render the OID.

 

snmpwalk -On -m ALL -M /usr/share/snmp/mibs/dell -v 2c -c "ourSNMPcommunity" hostnameOfSwitch IPV6-MIB::ipv6NetToMediaPhysAddress

Moderator

 • 

3.7K Posts

May 22nd, 2023 11:00

Hello swalker

 

When I see garbled output I would look at baud rate. Are you connected via console cable? Try checking different Baud rate.

 

Are any other commands returning garbled information?

 

Are you using the latest ver. 6.5.4.20 MIB,  Release-6.5.4.20-MIBs.zip from the firmware update?

I notice that Ver.6.2.6.6 fixed - NSeries-6.2.1.6-show buffers command shows incorrectly spaced or garbled output via telnet/SSH, but you are beyond that version.

 

If you are able, you could try a Power drain: Shut down, remove power for one minute. Reconnect power and power up.

 

If all that checks out and nothing helps; could you provide more information?

 

Was this working before and now is not working correctly?

     Was anything done on the switch around the time it started?

 

Does anything change if you try from a different workstation?

 

4 Posts

May 22nd, 2023 14:00

Hello,

When I see garbled output I would look at baud rate. Are you connected via console cable? Try checking different Baud rate.

This is via SNMP.  It's IP-based, so no console cable.


Are any other commands returning garbled information?

 

No.


Are you using the latest ver. 6.5.4.20 MIB,  Release-6.5.4.20-MIBs.zip from the firmware update?

Yep, just downloaded them.  I get the same result from this MIB as with the IETF-standard MIB.


If you are able, you could try a Power drain: Shut down, remove power for one minute. Reconnect power and power up.

This isn't really possible without planning a maintenance window, but just to confirm, this happens on both of our two switches of this model, located in different buildings, both of which were restarted during a maintenance window less than a month ago.  I absolutely understand the normal logic of "turn it off and back on again" but in this case, it's not really possible or justifiable, especially when it affects both of our redundant units.


Was this working before and now is not working correctly?

     Was anything done on the switch around the time it started?


This is a new implementation, so it was not something we have tried to use in the past.


Does anything change if you try from a different workstation?


Nope, I have tried this on two different Linux workstations loaded with the net-snmp package, using both the default IETF MIB files and the Dell-provided MIB files.


If all that checks out and nothing helps; could you provide more information?


Unfortunately, I think I've provided all the relevant information.  The switches are working 100% fine otherwise, and SNMP queries using the equivalent command for IPv4 ARP table information work fine.  It honestly seems like either:

  1. This is a bug, or
  2. The IPv6 address information, currently represented by sixteen (ASCII? certainly not hexadecimal) characters that are mostly dots, is somehow encoded in some way and needs to be decoded using some process that Dell does not seem to have documented.

The only other command I can provide would be a specific example of the command that's getting this information on our monitoring machine.  Given that this command functions perfectly for every other SNMP query, I doubt it will be useful, but just in case:

snmpwalk -m ALL -M /usr/share/snmp/mibs/dell -v 2c -c "ourSNMPcommunity" hostnameOfSwitch IPV6-MIB::ipv6NetToMediaPhysAddress

Variations of this have been tried:

  • with and without the -m argument that loads all MIB modules
  • with and without the -M argument that loads the Dell-provided MIB files
  • via SNMP v2, but also SNMPv3 (same results)

If Dell has any documentation (it's not in the switch's manual nor the Dell-provided MIB files) on how to decrypt this garbled information, or why it's there, it would be much appreciated!!

Thanks for your time.

Moderator

 • 

3.7K Posts

May 23rd, 2023 12:00

Hello swalker,

I'll need more time researching into this. I'll update you when I have more information.

4 Posts

May 26th, 2023 01:00

Hi Charles,


Could you provide the results of running the snmpwalk command using the "-On" modifier to fully render the OID.

snmpwalk -On -m ALL -M /usr/share/snmp/mibs/dell -v 2c -c "ourSNMPcommunity" hostnameOfSwitch IPV6-MIB::ipv6NetToMediaPhysAddress


Here is an example of the output  (there are hundreds of similar lines, one for each IPv6 address in the IPv6 neighbor table):

 

.1.3.6.1.2.1.55.1.12.1.2.947.254.128.0.0.0.0.0.0.8.215.166.89.144.164.99.239 = STRING: 78:7b:8a:ae:88:63

 

After checking in the IPv6 neighbour tables, that corresponds with the following link-local IPv6 address:

 

fe80::8d7:a659:90a4:63ef

 

So, it seems that that IPv6 address, which can be fully expanded to fe80:0000:0000:0000:08d7:a659:90a4:63ef, somehow corresponds to 254.128.0.0.0.0.0.0.8.215.166.89.144.164.99.239.

IPv6 addresses, 128 bits long, give addresses in hexadecimal, with each letter corresponding with four bits, for a total length of 32 hexadecimal characters.

For anyone who works with IPv4, the output from the command you provided, starting after the 947 (the interface identifier), seems like a string of 8-bit binary numbers (notice there are no numbers higher than 255), of which there are 16 - adding up to a total of 128 bits, like an IPv6 address.

I converted this string into groupings of eight bits of binary (the spaces represent where there are dots in the string that your command returned):

11111110 10000000 00000000 00000000 00000000 00000000 00000000 00000000 00001000 11010111 10100110 01011001 10010000 10100100 01100011 11101111

Then, I split it up, into groupings of four bits, with each one corresponding to a hexadecimal part of what hopefully ends up being an IPv6 address:

1111 1110 1000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 1101 0111 1010 0110 0101 1001 1001 0000 1010 0100 0110 0011 1110 1111

converting each group of four binary bits into hexadecimal gives:

f e 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 d 7 a 6 5 9 9 0 a 4 6 3 e f

Which, of course, looks a heck of a lot like an IPv6 address if you add colons every 4th character:

fe80:0000:0000:0000:08d7:a659:90a4:63ef

Shortened to: fe80::8d7:a659:90a4:63ef

So, that's the secret: When using the OID directly (for example, using the command provided by Charles), we get sixteen eight-bit decimal groupings that should each be individually converted into binary.  Then, after adding them all together, we cut that long binary number into 16 groups of four bits, and convert each group to hexadecimal to get the IPv6 address.

I have no clue why Dell would give IPv6 addresses in this way, instead of providing them in standard hexadecimal notation (as my Cisco switches do) or in binary directly, but at least this has given me the means to write a program that will do the conversion.  Thanks for your response, Charles!

No Events found!

Top