Re: port availability request

The Query->Other->Interface Counters form might be a more reliable
way to find the inactive interfaces. For example:

http://demo.inmon.com/its/query/Interface?date=today&resultField=agent
%2Cinterface%2CframesInTotal&resultFormat=csv

By setting the result fields to be "agent,interface,framesInTotal"
you can look for the interfaces that showed 0 packets entering the
interface, as counted by the hardware interface counters on the
switch. This avoids the issue of bridge-leakage and multicast/
broadcast traffic that Tim mentioned.

You could then combine the above with a second step where you look to
see which of those interfaces have ifAdminStatus = enabled.
Unfortunately that field can not be included as another result field
(at the moment) but you can find it in the text files under:

  /usr/local/inmon/server/state/agents/<IPAddress>/interfaces.sc

The first column in this colon-separated file is the ifIndex. If the
6th column is 1 or 3 that means the port is administratively enabled.

regards,
neil

On Aug 25, 2005, at 5:36 PM, Tim Durack wrote:

> You could query address location which will show ports that have
> learned addresses. Anything not in the report has obviously been
> inactive.
>
> Something like:
>
> http://demo.inmon.com/its/query/AddressLocation?
> addressType=IP&address=&agent=&interface=&resultFormat=html
>
> There is probably a config entry that allows you to control the aging
> of address information.
>
> Alternatively you could pull interface traffic for whatever period you
> are interested in. Again, any ports that haven't reported any traffic
> in the interval could be considered inactive. You would have to
> exclude
> any broadcast/multicast traffic from the report. Could also get some
> false negatives due to normal L2 flooding behaviour.
>
> Something like:
>
> http://demo.inmon.com/its/query/Monitor?filterProtocol=MAC&
> destinationAddress=!0x010000000000/0x010000000000&
> intervals=1&intervalSize=1&startTime=&TZ=null&
> agent=&interface=&path=&
> resultField=agentAddress,agentInterface&
> resultFormat=html&resultTruncate=10&resultProtocol=LAST&action=query
>
> agent and interface can be specified, or path to narrow the query.
>
> Tim:>
>
> --- Mark Beekhuizen <Mark.Beekhuizen@hsc.utah.edu> wrote:
>
>
>> We have an operational need to review port availability/usage across
>> our
>> enterprise on a per switch basis. Does someone have a report
>> template
>> for INMON that can report say, network ports that have not been
>> utilized
>> for x number of days? A follow on bonus would be a script that would
>> automatically disable unused switch ports, or assign them into a
>> private
>> VLAN upon the results of the 'unused port' report.
>>
>> thank you
>>
>>
>>
>> Mark A. Beekhuizen
>> University of Utah
>> Health Sciences Center
>> Network Support Manager
>> 585 Komas Drive
>> Suite 204
>> SLC, UT 84108
>> 801-587-6030 (work)
>> 801-916-9430 (mobile)
>> 801-339-7046 (pager)
>>
>>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
Received on Thu Aug 25 18:25:52 2005