cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Cisco Community Designated VIP Class of 2020

244
Views
0
Helpful
6
Replies
Highlighted
Beginner

Pull only MAC addresses from "show arp"

I'm doing inventory of my network devices across 7 routers. My perfect world would be to setup a kron on each router to run a "show arp" using attributes to pick the mac addresses out and then tftp it to my server. From there I could dump that into an excel sheet and run a compare between it and my inventory database exoprted to a excel (which has mac addresses entered).

 

The initial delema is that the attributes for "show arp" only deal with "lines" and no specifics within a line or a column from the output.

 

Is anyone aware of a way to do pull only the mac addesses from a "show arp"?

 

Thanks in advance,

Everyone's tags (2)
6 REPLIES 6
VIP Advisor

Re: Pull only MAC addresses from "show arp"

Regex is what you need. Scrape the output of sh arp and parse it line by line. From the following output:

Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  75.***.**.**            -   0017.59bf.2143  ARPA   FastEthernet0/1
Internet  192.168.2.6             1   904c.e52d.072c  ARPA   FastEthernet0/0.2
Internet  192.168.7.1             -   0017.59bf.2142  ARPA   FastEthernet0/0.24
Internet  75.**.**.*              0   001d.a2e8.0ad9  ARPA   FastEthernet0/1

 

...this regex will match the MAC address:

([0-9a-z]{4}.){2}[0-9a-z]{4}

 

 

Try it out here:

https://regex101.com/

 

cheers,

Seb.

Beginner

Re: Pull only MAC addresses from "show arp"

Thank you, I will try it.

 

Beginner

Re: Pull only MAC addresses from "show arp"

I would need something offline that I could also schedule. Thanks though.

VIP Advisor

Re: Pull only MAC addresses from "show arp"

In which case create a cron job to run a python script.

 

I recommend using the netmiko library for connecting to the switch and issuing the command. You would then parse the output with the above the regex and output to a CSV file named with a timestamp.

You could then audit these CSV at you leisure.

 

Check out my code in this post for a starting point:

https://community.cisco.com/t5/routing/basic-python-script/m-p/3785228

 

cheers,

Seb.

Beginner

Re: Pull only MAC addresses from "show arp"

Thanks again. I'm not much of a coder so I will take a look and try to piece it together. I appreciate it.

VIP Rising star

Re: Pull only MAC addresses from "show arp"

I would use either Python or Ansible to pull that out. Ansible with NTC module and TextFSM templates should do the trick. You can also straightaway write the results into a file.

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here