SNMP MAC address table switch incomplete for silent (listening) devices

[Ben4]

My environment contains multiple silent (listening) devices connected to the switch network. I noticed that the Network Interface overview of switch assets was incomplet for multiple ports. They are up but without a known MAC address for ports having a direct end-point attached. When investigating, the local mac address-table contained in the switch, it also didn't list the mac address for the relevant device at that port. After triggering a ping, it listed and was cleared conform the maximum aging time (default 300s) due to the lack of communiction from the device itself (a device listening but not broadcasting). The time difference between scanning the asset and scanning the switch is over 1 hour due to which the device is cleared from the mac table and not listed in the snmp scan of the relevant switch. This makes the switch overview incomplete. In the picture you can find the normal view and the view when I purposly pinging the end device just in front of triggering the switch scan.

My search for a remedy (like for example ping all known assets before snmp scanning a switch) didn't result in an answer. Anybody aware of some setting or workaround that exists?

__PRESENT

[Ben4]

Hi @ErikT,

Thanks for your reply. Increasing the maximum aging time on the switches can only be stretched limited (and would not match the normal scan sequence delay of 1 hour) without imposing network redundancy risks. Doing a batch scan indeed gives a same result as my manual ping for multiple assets at once but still comes down to a manual case by case process as far as I understand.

In the ideal scenario I could configure something that pings (without full port scanning) all known assets (default asset group) for that scanning server and afterwards scans the asset type switches immediately. Based on documentation, I guess limitations on scanning target setup don't go as deep to exclude a lot of protocols to strip it down to ping only.

Any thoughts or alternatives known that move towards an automated setup?

__PRESENT

__PRESENT

__PRESENT

__PRESENT__PRESENT

__PRESENT

__PRESENT

__PRESENT__PRESENT

__PRESENT

__PRESENT

__PRESENT

[ErikT]

Hi @Ben4 

Try extending the maximum aging time in the switch. Then try scanning both assets (switch and connected device) though batch scanning. 
https://community.lansweeper.com/t5/scanning-your-network/scanning-assets-with-batch-scanning/ta-p/6...