ARP and MAC table search

Hi there,

I see there is a report for ARP table searches which is great. Just a couple of things, any reason why this report doesn't incorporate the switch interface as well? For example, I have an endpoint that has been learned on VLAN 5 but doesnt show the switch interface to which the MAC is being learned from.

Also, why is this a report as opposed to a searchable field within the product?

Thanks

John//remove.video/adv

Find more posts tagged with

npm

report

Accepted answers

All comments

mesverrum

Because nobody at corporate ever took the time to make it an out of the box widget. Orion is often the kind of tool you have to roll up your sleeves and get used to just doing things yourself rather than waiting for them to implement a FR.

To make it searchable in a dashboard without running a report you could use the Custom Query widget with a query like below. This query assumes you have the NCM module, but there are also other ways you could make a similar query using other modules

Select  n.NodeCaption as [Source Node], i.InterfaceName as [Local Interface Name], i.InterfaceDescription as [Local Interface Description], arp.source as [Source], arp.MAC as [MAC], arp.IPAddress as [IP Address], arp.RDNSLookup as [Reverse DNS] 
From NCM.ArpTables arp
join ncm.nodes n on arp.NodeID = n.NodeID
Join ncm.Interfaces I on arp.NodeID = i.NodeID and i.InterfaceIndex = arp.InterfaceIndex

--Where arp.mac like '%${SEARCH_STRING}%'

In the custom query widget there is a tick box to enable search and you would paste in the same query, but remove the hyphens from the where condition i included to be able to search on MAC address

johnmcavoy1

Thanks for the reply.

It's been many years since using SW in anger and currently refreshing myself with it.

So it looks like the custom query is very powerful so I will take a proper look at that.

I must say though Im surprised Solarwinds have gone in this direction. Don't get me wrong having this capability is great however, one of the major compelling reasons for using SW in the past for me was that so much functionality was available out of the box and typically covered 80%+ of my use cases. Given there is such strong competition now from the likes of Netbrain, Forward networks etc I'm surprised they haven't tried to focus more in what this product can do to counter that?

//remove.video/adv

mesverrum

To be frank I think that one of solarwinds big advantages in the marketplace is that it is super cheap to license compared to most of their good competitors. Feels like part of that secret sauce is that they don't have devs spending cycles tweaking the views and such and rely heavily on the thwack community to ensure the UX can be good enough to get stuff done.

They views you are talking about haven't really been reworked in at least 8 or 10 years, but customers have been able to just solve this kind of gap for themselves that whole time. And what makes sense to a network engineer might seem like a waste of screen real estate to a sys admin so you have to consider the various user audiences