Managing Lots of IP Addresses?

haggisbrain asks: "I'm a Systems Administrator and I've recently started work with a new company where I'm now helping to support a much larger number of nodes than I've previously supported. We have just over 1000 nodes to support, but no efficient method to manage the IP addresses and subnets used. Previously, an Excel Spreadsheet has been sufficient enough for my needs, but now I need to find a new way. Can someone recommend a piece of software which can help me? Is there a simple way to list and view the IP addresses used on my network?"

Comments

Look@Lan

[bdr529]

Look@Lan It's a great little tool once you have it configured. It even will produce those nifty excel files for you if you wish. But man... I HATE that sonar sound effect. It's worse than the "UH OH!" sound made infamous by ICQ.

Re:Look@Lan

[empaler]

Hmm, I don't have speakers on this particular compy...
I'll venture a whirl.

Need more information

[HomelessInLaJolla]

What specifically is it about the spreadsheet m0del which is insufficient? I don't manage large blocks of IP addresses and subnets so I'm not familiar with the information which you'll be compiling or how you'll need to manipulate and mine it.

When other people figure out a complex organizational scheme for a spreadsheet they often turn it into a database. If you have kept a spreadsheet for a similar task, on a smaller scale, then you should be able to identify very quickly which axes you need to expand in order to accomodate the larger task.

Re:Need more information

[Spazmania]

When I worked for an ISP one of the tasks I had to deal with was, "Assign a /28 to customer X." That's a deceptively simple request.

First, some of my routers had as little as 16 megs of ram. Route aggregation is essential. So its not just assign it to customer X, its "Assign a /28 to customer X in network area A." That of course means that I first have to assign a superblock, say a /22 to network area A and install the /22 route at the borders of network area A. So now its, "Assign a /28 to customer X in network area A. Assign and route a new superblock to area A if necessary."

Second, there is the question of conservation. Today its assign a /28 but tomorrow it could be assign a /24. If I want to actually have a /24 tomorrow then I need to assign a /28 ideally from an available block in area A that's exactly a /28 long. If none are availale, I'd prefer to break a /27 (still in area A) rather than a /26 or a /25. So now its, "Assign a /28 from the smallest available block in network area A to customer X. Assign and route a new superblock to area A if necessary."

But, see, I've been doing this for years now and customers come and go. Quite a few of the blocks assigned in my list may be dead; no longer associated with active customers. I don't want to go breaking larger blocks if there's an assigned but dead /28 I can grab. So now its, "Clean dead assignments from the list. Then assign a /28 from the smallest available block in network area A to customer X. Assign and route a new superblock to area A if necessary."

And lets not forget reverse-DNS. Ideally I want the customer to have some sort of control over it. So now its, "Clean dead assignments from the list. Then assign a /28 from the smallest available block in network area A to customer X. Assign and route a new superblock to area A if necessary. Delegate the reverse DNS for those IP addresses to the customer."

Needless to say, a spreadsheet is not very helpful for any of this. Finding that optimal /28 from network area A is like searching for a needle in a haystack. What I really need a system that:

A. Processes the cancelled customer list so it knows which assigned blocks are dead,
B. Find's the optimal /28 for me from area A for me, and
C. Sets up an appropriate delegation so the customer will be able to manage the reverse-DNS for his IP addresses but no others.

And no, I never did find a good system to do this. I used a flat file that could be used to generate a graphic representation of the assigned addresses and tagged all blocks to customer ids so I could automatically check them against the accounting system. It was better than excel but it wasn't good.

Re:Need more information

[IAN]

While I'm not managing more than a couple of /22s, that's still a lot of subnets, as we're mainly doling out /29 and /28 blocks. I've had all of parent's issues (minus router memory, so far), and I'm still doing fine with a spreadsheet.

What's the trick? Visualisation. Look at the image:

• Each row is a single allocation.
• Unallocated subnets have a light yellow background.
• The leftmost column (dark gray boxes) tracks /28s, and the second column (light gray) tracks /27s.

So, if a box occupies a single row, the corresponding allocation is of that size (cf. 160/27, 192/27 and 224/28.) If it spans multiple rows, the allocation is subdivided. With a little practice, it's quite obvious if there's a free subnet, what size it is, how easy would it be to expand etc.

Re:Need more information

[shabble]

And no, I never did find a good system to do this.

What you describe doesn't sound terribly unlike how some implementations of malloc() work...

Re:Need more information

[Anonymous Coward]

You boring twat.

Re:Need more information

[bar-agent]

What you describe doesn't sound terribly unlike how some implementations of malloc() work...

Yeah, I was thinking that. Garbage collection, dude! It's a solved problem that just needs a GUI.

DHCP, FTW!!!!

[ELiTeUI]

DHCP, FTW!!!!

Re:DHCP, FTW!!!!

[dfoulger]

I see maybe a dozen DHCP answers already, so I'll just pick on this one. If he's asking for that large a block, DHCP almost certainly isn't an answer. Fixed IP addresses on a per server basis is important in some environments, especially managed server environments in which security is tied to specific addresses.

Re:DHCP, FTW!!!!

[flyingfsck]

So tie the IP to the MAC address and use DHCP to dish out fixed addresses - fixed till you decide to change it that is. This way, all IP addresses are in the DHCP configuration file.

Re:DHCP, FTW!!!!

[drsmithy]

I see maybe a dozen DHCP answers already, so I'll just pick on this one. If he's asking for that large a block, DHCP almost certainly isn't an answer. Fixed IP addresses on a per server basis is important in some environments, especially managed server environments in which security is tied to specific addresses.

Using DHCP does not preclude tying certain IPs to certain machines. You simply create a MAC <-> IP mapping and your DHCP client will always get the same IP.

I make this point because a hell of a lot of people seem to assume that DHCP == "changing IPs".

Re:DHCP, FTW!!!!

[squiggleslash]

FWIW, my entire home network (six "live" machines plus a few others) runs off DHCP and there's not a single computer without a static IP address. It's great. Reinstalling an OS doesn't involve manually setting up the network. If I change the server that provides DNS, or the default gateway, I can make one change centrally. If I ever plan to move off 10.x.x.x and onto, say, 192.168.x.x, it'd take me about five minutes to change everything centrally, and then all I have to do is reboot everything.

It may just be a small network in my case, but once you master DHCP, DNS, and a bit of shell scripting, there are relatively few limits to what you can do. Would it work for, say, routing large netblocks or anything like that? Of course not, but DHCP should be a component of any centrally managed IP addresses scheme.

Re:DHCP, FTW!!!!

[Miniluv]

So what, exactly, is more scalable about a flat text file than a sortable multi-field spreadsheet?

He's not saying its hard to ASSIGN the addresses to the actual boxes, he's saying its hard to keep records straight of which server has which IPs, what their gateways are, etc. Especially if you're dealing with supernets or other more complicated real world setups.

DHCP with reservations is indeed a good way to hand out the IPs, though I've yet to see a convincing argument of why its more efficient than properly managing the config on the servers. Especially for the multitude of real world situations for which DHCP is complicated at best and impossible at worst.

Re:DHCP, FTW!!!!

[dhasenan]

With a spreadsheet, I need to load a hefty graphical application to manage it. That means I am subject to its size limitations. They probably aren't that bad, and won't matter much in this case.

The submitter had about a thousand IPs to hand out. That's either a reasonably significant server farm or client machines. In either case, I don't want to have to pull a config file from a central server every time I reimage or replace a machine; instead, I just register the MAC address with the DHCP server and put the unaltered standard image on the machine. Granted, I could put a script on the image to retrieve or generate a config file from information on a central database, which would reduce the load.

DHCP with MAC-based ip assignment is ideal in situations where you have enough machines that managing configs manually is annoying and having a full-fledged database for them is overkill; and also when you don't have control of the client machines. If I knew of simple tools for managing ip configurations, I'd say the latter is the only situation where DHCP is necessary. Still, it's simple to implement.

Re:DHCP, FTW!!!!

[B'Trey]

DHCP is, in fact, irrelevant for this scenario as I understand it. He isn't assigning IPs to machines, which is what DHCP does. He's assigning blocks of IPs to other people for use as they see fit. The host using the IP might be sitting on the other side of two or three routers over which he has no control. It might not be assigned to a host or even a server. It might be assigned to a router interface. It might be assigned to a switches management VLAN. It might be one of a pool of IPs used in NATting a large number of hosts. Etc, etc, etc. The precise assignment of the IP is almost certainly not his responsibility and trying to track all of that additional info makes the job much harder, not easier. (Not to mention stepping on the toes of whomever he's assigning the IPs to. I know I'd be quite irritated if I had to go through my ISP to change where I"m using one of the IPs in my /30 block.) Anyone who suggests DHCP as an answer to this issue is either seriously misunderstanding the issue or has only cursory knowledge of the subject.

Re:DHCP, FTW!!!!

[Fastolfe]

Just because your home network works fine with DHCP does not mean this approach will scale to an enterprise level. By requiring that DHCP services be available when mission-critical servers boot up, you add a point of failure. If the DHCP server goes down, or the network between the host and the DHCP server is down when the server boots up, the server never gets an IP address and you potentially suffer an outage.

The cost of managing static IP address allocations for 1,000 hosts, and keeping those hosts configured appropriately, doesn't come close to the costs of maintaining a high-availability (and likely distributed) DHCP infrastructure.

You also can't use DHCP to solve the network topology problem. As you allocate IP netblocks to other organizations, you probably have to deal with aggregation and routing, so you're already going to have to track this stuff independently of DHCP.

I use DHCP at home too. It's great for hosts that provide no services, like my PCs or test/lab servers, but it's really inappropriate for larger scales, or for revenue-generating services. These need address stability, even when things aren't working elsewhere.

Re:DHCP, FTW!!!!

[squiggleslash]

You seem to have completely skipped over the last paragraph of my comment:

It may just be a small network in my case, but once you master DHCP, DNS, and a bit of shell scripting, there are relatively few limits to what you can do. Would it work for, say, routing large netblocks or anything like that? Of course not, but DHCP should be a component of any centrally managed IP addresses scheme.

And I stick by that. DHCP should be a component of any centally managed IP addresses scheme. It's proven technology and it works well. As a component it can provide "last mile" access to the wider database reliably and in a standard fashion.

Also your last paragraph makes no sense. Part of my reason for centrally managing IP addresses rather than manually configuring each of my machines on the machines themselves is precisely because computers on my home network do provide services. If I move DNS to a new server, or the IP gateway somewhere else, or want to change the entire IP topology of the network, DHCP makes the entire process a hell of a lot simpler. I don't have to remember which machines are using which services, and which ones are providing them.

Re:DHCP, FTW!!!!

[Fastolfe]

I didn't skip your last paragraph, but I did only read the first sentence, sorry.

If I move DNS to a new server, or the IP gateway somewhere else, or want to change the entire IP topology of the network, DHCP makes the entire process a hell of a lot simpler. I don't have to remember which machines are using which services, and which ones are providing them.

This seems backward to me too. If you don't know which systems are running which services, how did you get the services going on those machines to begin with? How do you know which systems you need to go to in order to turn those services OFF when you move them to another system? But even so, I'll agree with you that this is fine for small scales. But once you're at large scales, this information has to be tracked anyway, so there's no benefit to trying to insulate the administrator from some of it.

You didn't acknowledge the key point I was trying to make, though, which suggests that maybe I could have been clearer in my original post. With enterprise-scale services, outages cost a lot of money. Quite a lot of time and planning goes into designing network topologies and architectures to minimize risk and minimize points of failure. Requiring that DHCP services be up and available and renewing leases in order for your mission-critical servers to discover the network is a HUGE liability. If you're an online retailer, a DHCP outage could translate to a significant revenue-impacting event that would easily outweigh the additional administrative costs of NOT having a DHCP-managed IP address scheme.

In addition, there are lots of other factors here that make DHCP unsuitable for use with enterprise servers. Network topologies are complex, with DMZs for public-facing traffic, perhaps servers spread among multiple sites, and with WAN connections that are less reliable than LAN. Large servers have multiple network interfaces, and one of them might be a management interface for emergency use. Also, enterprise services tend to be a lot more stable (configuration-wise) than a home network, so things like renumbering or moving services between hosts are events that (a) happen very infrequently; and (b) when they do happen, they need to follow a very carefully controlled plan. "Reboot and hope DHCP assigns the new IP addresses" is a completely ridiculous service migration scenario for enterprise-scale applications.

For the record, I work at a major telecommunications company with thousands of servers, and since I've been here (10 years), we've never had a need to mass renumber, and all of our service migrations were carefully orchestrated and could NOT have been done cleanly if we had to rely on coordinated DHCP changes.

But really, for me, the availability aspect is the killer. Managing IP addresses by hand is not that expensive when the costs of any event that would require an IP address change are already in the hundreds if not thousands of dollars, just due to the scale/scope of the effort. On the other hand, the potential liabilities imposed by adding a point of failure in the form of DHCP servers (and the costs of making your DHCP clusters resilient to begin with) completely cancel that out.

In my opinion.

Re:DHCP, FTW!!!!

[jesboat]

dhcp supports redundant modes of operation; furthermore, you could have a few servers (or pairs of servers) for different segments of the network, and they could easily share the database and only differ in which subnet they're on.

Re:DHCP, FTW!!!!

[Fastolfe]

Except all of this costs a lot of money, and you're still never going to get to a 0.000% chance of failure. So you've cost the enterprise tens if not hundreds of thousands of dollars building this redundant, distributed DHCP infrastructure, and reduced the availability of your systems by some small (but non-zero) amount. What has that bought you? A slight reduction in the amount of hours worked by your administrators? Oops, we forgot about the administrators that we'd have to hire to maintain the dozens of DHCP clusters we'd have to deploy to make this work.

Re:DHCP, FTW!!!!

[jesboat]

The maximum you'd need would be two servers per segment, where a "server" could be as simple as a WRT54G running OpenWRT. (Those work very well, in fact.)

Maintenance is pretty darn trivial. Write a quick Perl script to generate and push the config files from a central database, and there basically isn't maintenance. (There is some, but nowhere near one administrator's work for a moderate- to medium-sized place.)

Furthermore, there are presumably routers somewhere holding the network together. You could use those to relay the DHCP to a single central cluster and drive administration even lower.

Re:DHCP, FTW!!!!

[Fastolfe]

Clearly you have no concept of "enterprise scale", so I don't think any of my arguments are going to mean anything to you. Come back when you've actually spent time in an IT shop with a billion dollars worth of high-end servers spread across a hundred subnets generating thousands of dollars of revenue a minute.

Re:DHCP, FTW!!!!

[jesboat]

I'm going to try to bring this discussion back to what we were actually saying at the beginning, if you don't mind [1]. I'm not going trying to argue that DHCP is God and solves every administration problem in existence. The only thing I am going to argue for right now is what I've actually asserted in my comments in this discussion. (Like the ancestor to this post, I think it's beneficial. Beneficial != solves all problems; beneficial == net gain. That's just full disclosure on my position.)

You said:

With enterprise-scale services, outages cost a lot of money. Quite a lot of time and planning goes into designing network topologies and architectures to minimize risk and minimize points of failure. Requiring that DHCP services be up and available and renewing leases in order for your mission-critical servers to discover the network is a HUGE liability. If you're an online retailer, a DHCP outage could translate to a significant revenue-impacting event that would easily outweigh the additional administrative costs of NOT having a DHCP-managed IP address scheme.

I said:

dhcp supports redundant modes of operation; furthermore, you could have a few servers (or pairs of servers) for different segments of the network, and they could easily share the database and only differ in which subnet they're on.

I was just pointing out that you don't have to rely on a single point of failure. A single DHCP point server is a single point of failure. A cluster isn't; DHCP services isn't, just like DNS isn't a single point of failure (if you're doing it right.)

A DHCP outage could translate to a horrible outage which would easily outweigh the administrative cost of a non-DHCP scheme. However, a mistake in configuring some server which could have been avoided with DHCP could also translate to a horrible outage which easily ... (etc.) If one route had no disadvantages, we probably wouldn't be having this discussion. Both choices do have disadvantages, and pointing those out is logically irrelevant. What you should be doing is considering which is least disadvantageous.

(As an aside, your reference to "the additional administrative costs of NOT having a DHCP-managed IP address scheme." acknowledges that DCHP has a lower administrative cost.) That brings us to:

Except all of this costs a lot of money, and you're still never going to get to a 0.000% chance of failure. So you've cost the enterprise tens if not hundreds of thousands of dollars building this redundant, distributed DHCP infrastructure, and reduced the availability of your systems by some small (but non-zero) amount. What has that bought you? A slight reduction in the amount of hours worked by your administrators? Oops, we forgot about the administrators that we'd have to hire to maintain the dozens of DHCP clusters we'd have to deploy to make this work.

You're not going to get a 0% chance of failure no matter what you do (for a reasonably definition of "chance".) I think the administrative overhead for maintaining the DHCP clusters is significantly less than the overhead maintaining a heap of servers with static configurations. The increased chance of failure should be sufficiently small as to be negligible. (How negligible? If the two servers were run the neglect with which I admin my personal computers, there'd be about an 00.018% chance of failure, empirically. That's after a healthy margin of error for non-professional computers.)

That only leaves raw cost for the DHCP servers, which is why I brought up:

The maximum you'd need would be two servers per segment, where a "server" could be as simple as a WRT54G running OpenWRT. (Those work very well, in fact.)

WRT54G's are the archetypal "cheap but unexpectedly useful device" (in my mind, at least.) Suggesting them for serious use is somewhat tongue-in-cheek, merely to demonstrate with how little the infrastruc

Uhhh...

[Talez]

Shouldn't your DHCP server have a list of its leases?

Re:Uhhh...

[Princeofcups]

> Shouldn't your DHCP server have a list of its leases?

The poster did not state that the nodes are end user PC's. Ever try using DHCP to assign addresses to your load balanced application servers? Oracle servers? er, DHCP servers? :-)

jfs

Re:Uhhh...

[tlhIngan]

The poster did not state that the nodes are end user PC's. Ever try using DHCP to assign addresses to your load balanced application servers? Oracle servers? er, DHCP servers? :-)

Don't most DHCP servers these days support assigning "static" IPs to hosts based on their MAC address? Hence if you do reconfigure the networ, all it takes is going to each server and releasing/renewing the DHCP lease on each of them, rather than trying to reconfigure the myriad of machines and IP addresses. (Plus, most OSes let you release/renew the DHCP lease as a "less-than-admin"). Or just restart them, whichever's easier. Leave the problem of static IPs to the much fewer DHCP servers you have.

And hey, I'm sure a script running on the DHCP server can notify the load balancer of machines that are actually up and have valid leases, so if a machine goes down, the load balancer will be notified within a lease period, and it's one less thing to actually do...

nmap & dhcp?

[khasim]

First off, just looking at your router configs should tell you what addresses are where.

Then, make sure you're using dhcp to assign the addresses.

Use nmap to check for weirdness.

Re:nmap & dhcp?

[Stephen Samuel]

The purpose of this tracking is to be able to specify the router configs, and having to talk to dozens of routers every time someone wants a block of IPs assigned is going to get onerous. That's why this person (and any sane person in a similar situation) would like a reasonably straightforward and central way of knowing what networks are (and can be) assigned where, and what the router configs should be.

Of course, after that I'd probably write a script to call up each router, compare their routing tables to what I think they should be an email me with any discrepancies.

Re:nmap & dhcp?

[necrogram]

that sounds all well and good, except when your network starts to get large and/or complicated. Take my campus. ~30 /24's (not all contiguously address) and and the rest of my network is pread over 4 VRF's (multipule routing instances). We took the route of delevoping an inhouse app to track it all.

When we put in the app we had 16 /24's on the campus and about 20 or so remote site's, it was a two month process getting everything documented and verified. I wouldnt want to try that today, and my net isnt *that* large.

Use your brain!

[Anonymous Coward]

You mean you can't remember a simple 1000 assignments?

IPplan

[yawble]

Hello 30 seconds on google:

http://iptrack.sourceforge.net/

Re:IPplan

[Anonymous Coward]

I've used IPplan in several instances to manage many thousands of addresses. Works well, will generate swips, DNS and DHCP config files, as well as running on most any platform.

Re:IPplan

[Builder]

I love it when someone asks for personal experience and advice, and someone else just points to some tool they found on google. No explanation of how good it is, no personal experience, but hey, I found it on Google so it must be good enough, right ?

Re:IPplan

[Anonymous Coward]

I have personally used IPPlan. It works well. Of course, so does Google.

Re:IPplan

[Anonymous Coward]

I agree with this post.

Dynamic Host Configuration Protocol

[Colin Smith]

Imagine using spreadsheets these days.

On top of DHCP, add Dynamic DNS and you're almost all set. Just make sure to use a DHCP and DNS server from the same producer, they're generally not 100% compatible with one-another if you don't. They might be 99% but that 1% creates a whole world of trouble.

Re:Dynamic Host Configuration Protocol

[TheRealMindChild]

Or, you can simply use DNSMasq

If only...

[Anonymous Coward]

If only there were some way to associate a friendly name with an IP address. Hmm...

What's wrong with DHCP and dynamically updated DNS? Servers will remain static, of course, but once you factor out clients there should be a manageable number of addresses left.

Re:If only...

[mikael]

What's wrong with DHCP and dynamically updated DNS?

You don't want users connecting their own systems onto the network whenever they feel like it. All PC's in our university have static IP's. And an alarm goes off whenever anyone as much as removes a single computer from the network. Even the cables from the router to the wall sockets are manually connected and disconnected. There are however, Wi-Fi areas for anyone who wishes to connect their laptops to the network, and users are free to use USB memory keys, CD/DVD burners and external drives.
Tech-support still have painful memories of when someone tried and failed to smuggle a PC out through the small bathroom windows in the block.

Re:If only...

[Anonymous Coward]

A decent DHCP server can easily be configured not to hand out addresses to anything. It can be configured to only hand out an address (dynamic or static, take your pick) to only a specific MAC address (or addresses).

>And an alarm goes off whenever anyone as much as removes a single computer from the network.

That'd be quite a bit of overhead, what with pinging every single machine constantly to check it's state. No DHCP server I've seen would do that, but with the open source DHCP servers, it wouldn't be too tough to implement.

>Even the cables from the router to the wall sockets are manually connected and disconnected.

That's not at the layer DHCP operates at, so yeah, that's a problem only the switch it's connected to can handle.

>There are however, Wi-Fi areas for anyone who wishes to connect their laptops to the network, and users are free to use USB memory keys, CD/DVD burners and external drives.

Something else, obviously, DHCP is designed for.

Really, it's a great tool. I'd still recommend setting up DHCP to hand out addresses to machines that aren't listed in the MAC address database, but they should be handed out an address on a network that isn't reachable by anything but the DHCP server. Lets you know that the machine is connecting OK, and, if you have the machine configured to allow you to push software on to it (to lock it down / whatever) you'll still be able to do that.

Re:If only...

[Anonymous Coward]

. . .

How would you automate the connection and disconnection of a cable from a device?

A souped-up tape library robotic arm, perhaps?

Re:If only...

[mysidia]

User may just turn the computer off before unplugging it. Assign its former Ip address and MAC address to their personal computer's network interface, and plug it back into the network. It doesn't matter whether you run DHCP service or not, you are just as vulnerable to attack. (Presumably if you DO run DHCP service on all your systems, you use static assignments, and if the MAC address is not registered, and assigned an address, the system does not get an IP.)

Your choice of network protocols CAN'T stop just whoever wants to from unplugging a standard network cable from one computer and plugging it into theirs, without physically blocking their access to the back of the computer, to all switches/switch ports, and not exposing any network line at an insecure spot (someone who truly wanted to, would physically be able to cut the cable, splice a junction, and slip a hub in, at any place where a network wire is exposed).

To make it impossible to plug in an unauthorized machine, you need physical barriers, or the switch needs to authenticate the computer -- using something like EAP/PEAP and a machine key, or require end nodes use VPN software to get anywhere. (You still rely on a perp not being able to gain administrative access over the domain/legitimate network member machine.)

Re:If only...

[Anonymous Coward]

And an alarm goes off whenever anyone as much as removes a single computer from the network.

So, if a computer crashes hard or is turned off, you get paged? That's got to be very annoying when the number of systems is greater than 100.

Even the cables from the router to the wall sockets are manually connected and disconnected.

I've never seen an automatic cat5 cable connecting/disconnecting machine. Where can I buy one?

Re:If only...

[flyingfsck]

Assign fixed addresses based on the MACs. Don't have a free pool.

Re:If only...

[allaryin]

Precisely. Suddenly your dhcp server config == your ip list, and you get an audit of all mac addresses on the system for free out of the deal ;) That same list allows you to firewall out clients who've not yet registered for a "dynamic" ip. It also allows you to actually use dhcp for dynamic assignment of ip's for classes of clients who don't actually need "static" addresses.

Re:If only...

[Anonymous Coward]

That's what 802.1x and port based authentication is for, if your environment calls for it.

The 90s called. They want their network management "solution" back.

Captcha: raping (wtf?)

Re:If only...

[zeugma-amp]

That works fine if you only have small systems where every box has one IP. What about the webservers where you are running 20-30 websites on a single box, or application servers with a similar number of unique IPs?

We've been dealing with spreadsheet hell at the company where I work for years now, and it is only getting worse. We've got huge multi-page spreadsheets with hundreds of nonroutable network subnets in them. Worst thing about this is that ultimately, the spreadsheets cannot really be trusted because there is no way to verify that each IP in the sheet is live, or even desired to still be reserved for a specific purpose, because over time, people leave, projects come and go, and networks change through mergers/acquisitions.

You also have the little fiefdoms to worry about where group X has control over a big bunch of IP address space, but because it is managed through MS-AD, it doesn't communicate with anything to help you to manage it, or at least the controlling organizations won't let you manage it from a global perspective.

Of the packages I've looked at in the open source world, IPPlan and Sauron seem to be just about good enough for the task, but neither one seems to be actively developed anymore.

Re:If only...

[Anonymous Coward]

Your choice of network protocols CAN'T stop just whoever wants to from unplugging a standard network cable from one computer and plugging it into theirs, without physically blocking their access to the back of the computer, to all switches/switch ports, and not exposing any network line at an insecure spot

The fact that it's possible to defeat a security measure, given sufficient skill, doesn't mean that it's worthless. Locking down to assigned MACs is useful in stopping idiots turning up with unpatched laptops.

Re:If only...

[mikael]

I should have added more detail - in the case of our room, we have medium sized locked cabinet mounted about 12 foor above the floor. Inside are there are couple of Nortel Network Baystack switches. Whenever a machine is added or removed from the room, the technicians come in, unlock the cabinet and connect a cable from the switches to the distributor box. We don't have the alarm system in our room, but the public computer rooms do... people get confused between the fire alarm and the 'someone's unplugged a computer from the network' alarm.

Re:If only...

[alienmole]

Just a tangential point, if you have 20-30 websites on a single box, you don't need more than 1 IP address unless you're either trying to pretend they're different machines for anyone who investigates, or are hosting for multiple customers and have agreed to give them each their own IP.

Just like the average ask slashdot..

[WhatAmIDoingHere]

"Hey, Slashdot, I don't know how to do my job.. please help me. I could PROBABLY google around for 30-40 seconds and find a solution, and earning my paycheck by doing so.. but I figure I'll waste everyone's time."

Re:Just like the average ask slashdot..

[sk8king]

What an annoying comment....perhaps a troll.

Asking slashdot is informative for everyone. Sure, google may turn up a few thousand hits, but there may still be some gems hidden in there that slashdot can provide links to.

Maybe people will find a new version/product that they didn't know they wanted/needed.

Re:Just like the average ask slashdot..

[Matt Perry]

"Hey, Slashdot, I don't know how to do my job.. please help me. I could PROBABLY google around for 30-40 seconds and find a solution, and earning my paycheck by doing so.. but I figure I'll waste everyone's time."

"Hey Slashdot, I'm good at my job but I don't know everything.. please help me. I've already googled around for at least an hour to see what solutions exist. Being a social and intelligent human being who doesn't live in a vacuum, I'd love to have a conversation with other administrators about what solutions they have found valuable. I'm hoping that I can learn something those who have already investigated these solutions. I want to learn from your experience and leave a public record on Slashdot for other people who might have the same need in the future."

Re:Just like the average ask slashdot..

[Anonymous Coward]

You're kidding, right?

Anyone who's had an IT position at a level slightly above Geeksquad tech would know to use DHCP/DNS. Anyone who's administered a home network I would assume knows how DHCP works.

Its questions like these that make me understand the perception on /. that the tech market is in the shitter. There's a boatload of morons who have no business working in IT, and the OP is a perfect example.

Re:Just like the average ask slashdot..

[Targon]

When you are looking at 1000 machines, it goes a bit beyond just using DHCP and DNS because of the routing that SHOULD be involved in that large of an environment. If you use a straight DHCP, you STILL need to set up a system to identify WHERE a given IP address might be as well, just in case something illegal or just against company policy is going on.

Dynamic is nice if you plan to be hands-off, but it CAN be a royal pain if you need to be responsible for the environment.

Re:Just like the average ask slashdot..

[Anonymous Coward]

Asking slashdot is informative for everyone.
Exactly. I read /. to learn information from all kinds of fields. I am not a net admin, and browsing this article I learn a few stuff that answers my curiosity, and might even help me one day.

If a reader don't like an article, do like me ... skip it.

Re:Just like the average ask slashdot..

[cepler]

You're new here aren't you?

Managing IPs / DNS

[bernywork]

This question has come up once or twice before.

The usual suspects for answers to this question are as follows:

NorthStar, which is quite feature rich. "NorthStar is a system to help track and allocate blocks in an IP Network"

IPplan which is another open source product.

And PHPip

If you want to go commercial VitalQIP Enterprise could suit your needs quite well.

Berny

Re:Managing IPs / DNS

[Guido von Guido]

DNS doesn't keep track of subnets and assignments for you, and other miscellaneous information you might need. Yeah, you can kind of backload into it into DNS, but it ain't pretty. "Just ssh to wwww1-bigcustomer-25..." Also, individual departments or customers might have their own needs or desires for DNS. After a while, enough exceptions build up to make DNS much less valuable as a tracking/management system.

We rolled our own IP address management system. Postgres apparently has some IP-specific data types, which allowed us to throw in a bunch of other stuff which we've found very useful.

Re:Managing IPs / DNS

[anticypher]

These are some of the best tools out there, but none of them really are suited to managing large IP space allocations efficiently, or have the ability to produce clear reports for network managers configuring routers. None of them support IPv6 addresses (the QIP sales weasels kept making hollow promises, but now admit since the lucent/alcatel mutual ass-reaming, that the sun will go nova before it happens).

Northstar works for what it does, but it's abandonware. I guess the author graduated and no longer works for an ISP, but there hasn't been an update since 2003. I've used it on one project, and except for a bit of a learning curve about all the limitations and procedures to get usable information in and out, it worked pretty well. I couldn't see using it to manage a whole /16 of space, though.

IPPlan/IPTrack has a quite active development community, which is reassuring. I tried once to get it working, but just ran into way too many install/config/usability issues. It looks like the developers actually worked on those issues since then, and it may be time to try it again. But it is more oriented towards managing DNS files, rather than helping a network admin to configure routers. The worrying part is the childish attitude of the developers when presented with reasonable requests in the forum, they sound like 4 year olds.

Never heard of PHPip, but it seems oriented towards managing Active Directory and DNS servers, rather than anything useful for planning IP allocations.

I've known admins subjected to the horrors of QIP, I understand there is a program to help them recover but if you ask them about their experiences they just get a thousand yard stare and start quivering uncontrollably. The product started as an overdesigned DNS/DHCP/DynDNS server, which has had functionality cobbled on over time. It supposedly requires at least one full time DB admin and system admin, and was originally targeted at only the largest of ISPs who had millions of customers on dial-up or megacorps with 10s of thousands of machines. With broadband and static addressing, it has pretty much lost its reason for being, as a well designed BIND installation is far easier to manage. The IP allocation tool is the only one I've ever seen that properly deals with the hierarchy of IP addresses, and it integrates with RIRs to pull data from and update the IR DB. But the web based interface of the IP planning/allocation functions looks quite similar to Northstar and IPPlan, so given the choice between 30,000Euros/year licensing costs or one of the free/libre options, this being /. there isn't much to recommend QIP.

Someone with a 7 digit /. ID mentioned Look@Lan, which is also free and no longer actively developed/supported. Its a windows product, that ping sweeps and snmp sweeps the network, and creates lists of what it finds. I've seen a few small customer sites use it, for basic network monitoring its fine, but it is no allocation or planning tool.

There must be at least one other commercial planning/allocation tool out there, because every time the RIPE or ARIN changes the interface or structure of the IRDB, lots of people scream about how all their automated tools broke.

Back to the IPv6 notice above. Last year I had an intern working for me, and for his project I asked him to research wiki or other web based documentation projects that could deal with tables of IPv4 and IPv6 addresses. His job was to set up and test wikis to see if they could search on partial or complete IPv4 or IPv6 addresses, and properly format tables 5 or 6 columns wide and maybe hundreds of rows long. In the end, he didn't find a single wiki that could do either of those functions well enough to use without major patching and kludging. If he comes back for another internship next semester, maybe I'll get him to cobble together something that combines the best of Northstar and IPPlan, but deals with IPv6 and hierarchy correctly.

the AC

Network management

[Colin Smith]

Is there a simple way to list and view the IP addresses used on my network?" man fping. Though with 1000 nodes I'd be heading up to a network management system, something with autodiscovery. jffnms, opennms, zenoss or similar.

Re:Network management

[flyingfsck]

Neat. I wasn't aware of fping and I like quick and dirty solutions.

One Word...

[consumer_whore]

NAT! Oh wait, never mind :(

Ubersmith Datacetner Edition

[casualsax3]

My company has been using Ubersmith Datacenter Edition (Uber DE, for those in the know) for a few months now - the IP management stuff they've integrated into the device manager is pretty slick to say the least. We've done the spreadsheet before, as well as North*, but neither of those options mesh well with any external systems. If you've got hardware/network stuff to manage as well (which I assume you do) give the Ubersmith guys a call. I don't think there's an online demo of DE yet (lame) but when we were interested in the system we called up and one of the developers gave us a walkthrough of a live build, explaining what was going on. http://www.ubersmith.com/

ummmm.... DNS...

[Fallen Kell]

It is pretty much what it was designed to do (i.e. manage all your IP addresses to Names). As a result, a good DNS application will manage ALL your subnets, virtual lans, static addresses, and DHCP addresses.

Personally I like Lucent's VitalQIP.

Grep, cut, sed, awk

[HomelessInLaJolla]

Sounds like a task for shell scripts to manipulate an ASCII file and grep | cut | sed or maybe awk if the plain ASCII file is formatted correctly. I don't want to be drawn into UUOC.

Sure you could do it in C if you're familiar with the IO and text manipulations in that language--I always wanted to learn C but never devoted enough free time to it. The largest motivator to write the system from scratch in C is if the list becomes long enough that grep and awk can't process it quickly enough to keep up with incoming requests or if requests come through so often that beating up the disk platters is a consideration.

One IP address per line with twenty or thirty well planned fields, comma separated, should be good for the task. How many functions do you suppose you'd need to manipulate it properly? A well thought out system of functions could probably be reduced to ten or twelve basic functions which could be combined to do nearly anything.

The largest motivator that I find for using someone else's software is that someone else usually has more time to dress it up to look nice and neat on the display. I just make it work.

Re:Grep, cut, sed, awk

[Sancho]

C isn't really suited for text manipulation. It's unlikely that you'd need the raw power C gives for such a small task (unless you're running on really old computers). You could get away with Perl--this is basically what it was designed for.

Re:Grep, cut, sed, awk

[Cato]

If there's no suitable application out there, I would do this with Perl, starting with a prototype that just reads in text files, processes them, and writes them back - then you can graduate to a more sophisticated version that uses a database if needed.

However, the relevant searching would take some time to do efficiently in a DB, and the stated number of subnets is quite small, so writing the algorithms in Perl would be easier - and as I expected there are some potentially useful CPAN modules:

- http://search.cpan.org/~luismunoz/NetAddr-IP-4.004 /IP.pm - NetAddr::IP, lets you manipulate IP addresses and subnets, including splitting and merging
- http://search.cpan.org/~muir/Net-Netmask-1.9015/Ne tmask.pod - manipulate netblocks, closer to what's needed

Of course, on Windows Perl you can even use Perl as a macro language to manipulate Excel spreadsheets via OLE - or on *nix you can just read the Excel values directly from Perl without converting to CSV. See CPAN for details...

Re:Grep, cut, sed, awk

[Sancho]

Indeed. We use many of the Networking-based libraries in my office. They're quite useful.

nmap and traceroute

[muftak]

You only need 2 tools for managing your address space.

Nmap - To see which addresses are in use and what the servers are doing.
Traceroute - To see where in your network the IP address is.

Also make sure your reverse DNS is updated when you assign an address to something important.

Cheops-NG

[ET_Fleshy]

I like Cheops-ng, though I'm not sure if that's exactly what you're looking for. Also, I wouldn't run it during peak business hours -- don't wanna clog those tubes ;)

Previous Ask Slashdot discussion

[josath]

Maybe you can find some useful info here, this topic came up about a year ago:
http://ask.slashdot.org/article.pl?sid=06/04/26/22 51224

Not too difficult

[Anonymous Coward]

nmap -sP 192.168.1.0/24

Adjust as necessary.
I.E.
nmap -sP 192.168.2.0/24
nmap -sP 192.168.3.0/24
nmap -sP 192.0.0.0/8
nmap -sP 10.0.0.0/8

The possibilities are endless.

What's your environment like?

[jonabbey]

We designed some software that we use to manage our IP network, called Ganymede. It's designed to track data in a transactional object store, then turn around and re-build BIND files, NIS maps, and whatever other directory services data you care to manage with it. It's a bit unconventional, but if you need to be able to have full scripting control over your environment, it's really very powerful.

Drop me an email if you're interested in talking about it.

virtualization..

[Anonymous Coward]

.. would be the way to go

You REALLY don't want to be bothered administrating a 1000 ip addresses manually.
That is like doing pointer math in C; nothing to see (read: gain) here, move on, don't get passed by.
You would probably be an early adoptor, have to invest in dedicated hardware, meet
a lot of fud, resistance and ignorance, but it is the way to "the future", so don't be backward ;-)

There is not really much info out there yet, but give the big guys (Cisco, HP) a shot, they
will probably be happy to talk to you, and explain what it is about.

Use a database

[TheLink]

For the IP part, postgresql has network operators and functions that can come in very useful.

http://www.postgresql.org/docs/current/static/func tions-net.html

So in theory you could have a script for "A" and "B" to automatically free up and find blocks.
And a script for "C" to actually allocate a manually decided block and set up the delegation etc.

Doesn't actually seem too hard if you start with a decent database schema, and are using sane DNS software ;).

Of course there are super expensive off the shelf solutions to do all sorts of stuff, but funny thing is you'd probably have to spend about the same amount of time and effort integrating them with your DNS, routers etc.

Using the right tool for the job

[Sloppy]

Previously, an Excel Spreadsheet has been sufficient enough for my needs

Awesome. By using a spreadsheet, you can "what if?" and see what would happen if you were to change a certain node's address, as the change instantly propogates through various calculations, ultimately altering that final cell either subtly, or drastically. You can even make a pie chart that shows the addresses!

But best of all, since it's not just a spreadsheet -- it's an Excel(TM) spreadsheet! -- you have the advantage of Microsoft's advanced proprietary technology. Pity the fool who has to settle for Lotus 1-2-3 to .. um .. record a list.

Stick with a spreadsheet. It's only 1000 nodes.

[amper]

Seriously. You have "just over 1000 nodes" to manage. Odds are, the vast majority of those are dynamically assigned (or they should be, so if they aren't, that's your first job). Of the ones that are left, I would venture to guess that the number is much smaller than 1000, and could probably be even smaller than you think given the availability of modern protocols like Zeroconf. After that, you need to consider how often those statically assigned devices are going to change, which is probably not very often at all, if ever.

If you're using DHCP and DDNS like you oughter, the few times you might need to look up one of the dynaically assigned numbers will take a very short period of time.

As an example, one of my clients right now has about 150-200 nodes on the network in two locations, approximately 50% Windows and 50% Mac OS X, with a couple of Linux machines scattered around, mostly for my benefit. Between the two sites, we're using two /16 subnets (because we're in the process of migrating to a completely new AD system and we were running out of easily rememberable addresses in the one /24 we were using). Out of those two /16's, about 18 /24's are actually being used. The "0" subnet in each /16 goes to routers, the "1" subnet goes to managable switches and other Layer 2 devices, the "2" subnet goes to servers, the "3" subnet goes to printers, the "4" subnet to the few statically assigned workstations, and the "10" through "13" subnets go to two different DHCP server pools, for redundancy.

All the DHCP and DDNS is handled by Windows Server 2003, simply because Windows is happier if it gets its own way for those purposes in an Active Directory environment, and its a hell of a lot easier than setting up BIND, etc., to do what Windows wants done. Apple's Open Directory doesn't care, as long as the DNS servers are up and properly configured before you configure OD. The second site gets it's DHCP from the local router, because the site only supports about eight users with no server. Microsoft's DDNS server doesn't mind.

The DHCP pools can be looked up at will in one Windows application (or through VNC back to my management station from any of the Macs), so they don't need to be tracked. Even the statically assigned devices which report properly to the DDNS can be looked up at will. The routers, switches, and infrastructure servers don't change, and there's few enough of them (eight or so switches and access points, ten or so servers, and this is overkill to a certain extent--the system we've built could easily handle your 1000 nodes) that anyone can remember them all, even with multiple interfaces. The printers will eventually be moved to dynamic addresses as they are replaced with Zeroconf capable units. In fact, even some of the servers could be moved to the DHCP pool if all their services and clients support Zeroconf. The only serious problem we have is keeping track of which ports are in which VLAN as we migrate from one system to the other, but eventually we'll collapse the VLANs, because they're really not needed. Perhaps you might find VLANs more useful in your larger network, but that's another topic... There's a small possibility we may use VLANs at some point to decrease the size of the broadcast domains, but its not really an issue, yet.

All of this is tracked in spreadsheets, and one of the really neat things about spreadsheets is that they're really easy to convert into databases at some point if that's what you decide to do. It's a simple matter to update them every so often. Sometimes computers aren't the right answer.

Re:Stick with a spreadsheet. It's only 1000 nodes.

[amper]

I of course forgot to mention the most important point.

The first thing you want to nail down is a consistent convention for naming and numbering. Everything will fall right into place after that.

Take a look at BT Diamond IP

[Anonymous Coward]

BT Diamond IP came from the people who originally came up with QIP, it is extremely feature rich and you can buy it as an appliance.

http://bt.ins.com/software/

Depends on your needs...

[rivendahl]

I work for a large IT company managing well over 50,000 IP addresses. We looked at several off the shelf products, including VitalIP, but as we have a dynamic mix of DNS, DHCP, and hosts files, we could not reliably manage that many IPs in Access, Excel, or any off the shelf product (that we reviewed at the time; 2003). We already had an in-house developed app doing the job, so we just decided to modify it. Honestly, a few hours of Oracle development to create the tables, a week of VB.NET programming, and we had a fully functional IP management tool complete with business rules for assigning IPs based on a schema. While is it was fairly easy as we knew very intimiately our needs, it may not be as easy for you. I'd suggest starting a list of requirements and the moment you feel overwhelmed you know you're on to something. Use that to determine whether you need off the shelf or develop (re-develop, or OSS).

It's a joke!!! save your mod points, really

[drachenstern]

Exactly, 4*250 = 1000 and 250254 thus you should only have to count each finger 250 times to remember where you left off /sarcasm

Carnegie Mellon's NetReg

[vitroth]

Carnegie Mellon's NetReg is an open source system that provides a pretty complete IP Address Management toolset, including management of DNS & DHCP configurations for ISC bind/dhcpd.

Rather then just repeating what I said the last time the subject of IP Address Management came up on slashdot, I'll just link to it.

Browse the NANOG archives

[Magic5Ball]

The subject is slightly below the charter, but many great links get posted.
http://www.nanog.org/mailinglist.html

We use IPPlan

[amorsen]

IPPlan is what we use. It is by far not perfect, and we have basically switched to doing most modifications directly into the (Postgres) database. IPPlan was developed for MySQL, so it doesn't use the IP address features of Postgres. We have added a few stored procedures which keep an extra column in ip4r format, for easier manipulation by other tools.

Why IPPlan? Because the other free alternatives are even worse.

Access Database

[sjipca]

I think a good solution to be is make one database with many queries and if you keep updating the main table the queries will change with it. You can use Between This Number and That Number so that only those IP Address would show up if this was me i'd set it up either by network node or Workstation Name.

Home Grown Sometimes Best

[pyite]

At Rutgers University, we have a home grown tool called NetDB that we use to manage IP allocations, assignment of networks to individual departments, corresponding DNS, and custom Access Control Lists. It works rather well. Network Operations allocates a network for a department and assigns it to the appropriate Network Contact Group (NCG). From that point, the people who have certain privileges on that NCG have the ability to add/remove DNS for it and create custom access lists. The tool knows what OSPF areas to allocate addresses from based on zones, and all in all is pretty neat. Here is some documentation (including screenshots) for ideas should you decide to ever work on your own tool.

Modify

[HomelessInLaJolla]

The largest motivator to write the system from scratch in C is if the list becomes long enough that grep and awk can't process it quickly enough to keep up with incoming requests or if requests come through so often that beating up the disk platters is a consideration. Use a RAMdisk.

Re:Modify

[Short Circuit]

It's called tmpfs these days.

Re:Modify

[HomelessInLaJolla]

Googlefight agrees

Big Blue Tool

[mutterc]

I used to work at a certain large business machine company with their own class A. There was an internal website one could go to, "iptools". You entered info on who you were, your dept, type of machine, physical location, etc. and it would assign you an IP. It had tools for when you moved a machine from one subnet to another (like when moving buildings) as well.

There were monitoring machines that could tell when IPs were being used. If you didn't use a machine for a while (months?) you'd get an email from the "IP Police" telling you to re-register or the IP would go back in the pool.

IP Address Management

[ingerc]

To view and manage the IP addresses/subnets and IP space, I would recommend looking into an IP Address Management solution that would eliminate spreadsheet data entry. Address Commander by Incognito is one solution. It tracks organization-wide IP address space; links all IP addresses with business units and, regional offices, subscribers or other entities; centralizes address allocation policies; and automates the reporting and receipt of IP address space from RIR (ARIN/RIPE). Would that serve your purpose? Are you a Sys-Admin in Cable/DSL service provider or in an Enterprise? Also, another thing to consider, if you wanted to also manage DHCP services on your network, you could also look into Broadband Command Center, which would work together with Address Commander as a complete DHCP and IP Management solution.

1000 nodes?

[nurb432]

Geesh.. that is nothing. try more like 100000 nodes like some of us..

You could manage 1000 on the back of a napkin almost.

justf'ingoogleit

[alienmole]

Part of the point is that these days, if the person asking a question like this does absolutely no research via a search engine, then they're really wasting everyone's time, and all they deserve is a link to www.justfuckinggoogleit.com. If you want to ask the question more seriously, then you look around for what you can find, and post a question that indicates that you've done some minimal amount of research before throwing yourself on the mercy of a random group of strangers.

Re:justf'ingoogleit

[djlowe]

No, the REAL question is: Why was the article posted in the first place? It's pretty much "remedial TCP/IP network administration", in this day and age, and isn't "News for Nerds", nor "Stuff that Matters".

Which is basically what you said, but with much less tact :)

Regards,

dj

Alternative to excel spread sheets

[bigredradio]

You could always try OpenOffice Calc.