From: lars@spectrum.CMC.COM (Lars Poulsen)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: TCP/IP Addressing in Large Networks
Date: 30 Jul 92 06:22:42 GMT
Organization: CMC Network Systems (Rockwell DCD), Santa Barbara, CA, USA

In article <1992Jul29.191829.13780@newshost.lanl.gov>
   smj@beta.lanl.gov (Stephen M. Johnson) writes:
>I work for a large Department of Energy facility (325 square miles, 23,000 
>people) with a large IP population.         ...             We have a great 
>deal of trouble maintaining an accurate host database because PCs are easily
>moved, etc. We are struggling internally with how to manage IP addresses
>so that we maintain an accurate database and consume minimal people resources
>doing so.

Our facility is much smaller; about 150 people, 200 nodes. Still enough
to be a hassle to keep the host maps and name server files current.

We run a promiscuous monitor program for an hour each morning and again
in the afternoon and evening. This maintains a list of all IP addresses
and ethernet addresses that have been seen on our backbone. It then
proceeds to supplement this with information from DNS whenever
available.

Here is a sample of the database:

# Host Tracker Database hostdata updated 29-Jul-92 19.26 on spectrum
#
02-CF-1F-40-06-40 : 131.143.16.20  :29-Jul-92 19.23 :
	CMCVAX.CMC.COM : VAX-11/750:Unix 4.3BSD:MIS - In Computer Room:Ip:
08-00-20-00-77-C0 : 131.143.16.30  :29-Jul-92 19.23 :
	Amos.CMC.COM : Sun-3/280:SunOS 4.1.1:Brian Fanning:LmIp:
AA-00-04-00-03-04 : 131.143.16.39  :29-Jul-92 19.23 :
	THUMPER.CMC.COM : MicroVAX 3800:VMS:Carol Boyce:Ip:
08-00-86-00-08-E7 : 131.143.16.40  :23-Jul-92 16.40 :
	ILP.CMC.COM : Imagen-5320:?:Brian Fanning:Ip:
02-CF-1F-50-06-14 : 131.143.16.80  :29-Jul-92 09.49 :
	THUMPER.CMC.COM : MicroVAX 3800:VMS:Carol Boyce:Ip:
02-CF-1F-90-51-40 : 131.143.16.200 :29-Jul-92 16.09 :
	CIRRUS.CMC.COM : TranServer:TranServer:M Kunz:IpBtp:

Etheraddress : IPaddress : last-seen :
	DNSname : Hardware : Software : Owner : Flags

Separate files track local hosts (i.e. the ethernet address is real) and
remote hosts (i.e. they are behind IP routers). The program also logs
usage statistics and some exceptions:

29-Jul-92 19.00 My name is spectrum - IP address 131.143.16.1
Loaded hostdata    216 (0 remote, 216 local) 303 TRIE entries
Loaded host.mac    297 (3 remote, 294 local) 320 TRIE entries
Loaded host.rmt   2265 (1971 remote, 294 local) 2343 TRIE entries
Initializing translation tables, please wait... done
open(/dev/nit) returned 3, errno=0
+++19.00 Saw new remote host 128.111.246.4   via gateway HINGE.CMC.COM
---19.01   4701 frames  4873920 bytes (40/2558 M/B) 6.59% saturation
---19.02    778 frames   144645 bytes (44/3242 M/B) 0.21% saturation
+++19.05 Saw new remote host 128.2.209.227   via gateway HINGE.CMC.COM
---19.11   1483 frames   325784 bytes (45/3284 M/B) 0.46% saturation
---19.17   1318 frames   306619 bytes (48/3772 M/B) 0.44% saturation
***19.24 Exiting: No new stations seen in  5 minutes
Total frames:  44344 - Total bytes =  22552620 - Max saturation = 6.59
B/M-c frames:   1000 - B/M-c bytes =     67696 - Max b/m-c bytes =  3772
Total hosts   2267 (1973 remote, 294 local) 2352 TRIE entries
Identified IP 128.2.209.227   name TEZUKA.REST.RI.CMU.EDU
Major traffic from 128.2.209.227   (null) (21.0%)
Identified IP 128.93.8.8      name chenas.inria.fr
Identified IP 128.111.246.4   name IRIS4.metiu.ucsb.edu
Identified IP 128.117.140.3   name unidata.ucar.edu
Identified IP 128.174.5.98    name vmd.cso.uiuc.edu
Major traffic from 129.192.64.25   FENNEL.ACC.COM (17.4%)
Major traffic from 131.143.16.39   THUMPER.CMC.COM (20.3%)
Major traffic from 131.143.18.40   TANAFIEL.CMC.COM (9.5%)
Major traffic from 131.143.23.16   JAMMER.CMC.COM (6.5%)
Major traffic from 131.143.23.90   bigsky.CMC.COM (26.4%)
*** 29-Jul-92 19.26 All done!! (Pmon3 rev 1.26)

The log file is reviewed periodically. This provides a good sanity check
on the network. The cumulative database is used to generate /etc/host
files as well as forward and reverse DNS zone files, complete with
HINFO data. When adding new hosts, we generally assign them an IP
address, plug them in, harvest their MAC address and manually add the
HINFO fields. We then regenerate the DNS zones, using perl scripsts that
parse the database.

The remote host file gives us a rough idea of who we exchange mail with;
it is also good for browsing ... I know there's an FTP server at IBM,
but I can't remember its name ... when users have questions.

Finally, the timestamp helps us periodically harvest IP addresses that
have fallen into disuse as labs have been reconfigured.

If I had your size of network, I would expand this with some modules to
collect the information remotely via RMON devices, and tag each host
with the ethernet segment number it lives on, rather than a local/remote
bit. This is of course a monumental task.

their ethernet address
-- 
/ Lars Poulsen, SMTS Software Engineer	Internet E-mail: lars@CMC.COM
  CMC (Rockwell Digital Systems)	Telephone: +1-805-968-4262	
  Santa Barbara, CA 93117-5503		TeleFAX:   +1-805-968-8256