Managing Lots of IP Addresses?

haggisbrain asks: "I'm a Systems Administrator and I've recently started work with a new company where I'm now helping to support a much larger number of nodes than I've previously supported. We have just over 1000 nodes to support, but no efficient method to manage the IP addresses and subnets used. Previously, an Excel Spreadsheet has been sufficient enough for my needs, but now I need to find a new way. Can someone recommend a piece of software which can help me? Is there a simple way to list and view the IP addresses used on my network?"

Comments

Look@Lan

[bdr529]

Look@Lan It's a great little tool once you have it configured. It even will produce those nifty excel files for you if you wish. But man... I HATE that sonar sound effect. It's worse than the "UH OH!" sound made infamous by ICQ.

Need more information

[HomelessInLaJolla]

What specifically is it about the spreadsheet m0del which is insufficient? I don't manage large blocks of IP addresses and subnets so I'm not familiar with the information which you'll be compiling or how you'll need to manipulate and mine it.

When other people figure out a complex organizational scheme for a spreadsheet they often turn it into a database. If you have kept a spreadsheet for a similar task, on a smaller scale, then you should be able to identify very quickly which axes you need to expand in order to accomodate the larger task.

Re:Need more information

[Spazmania]

When I worked for an ISP one of the tasks I had to deal with was, "Assign a /28 to customer X." That's a deceptively simple request.

First, some of my routers had as little as 16 megs of ram. Route aggregation is essential. So its not just assign it to customer X, its "Assign a /28 to customer X in network area A." That of course means that I first have to assign a superblock, say a /22 to network area A and install the /22 route at the borders of network area A. So now its, "Assign a /28 to customer X in network area A. Assign and route a new superblock to area A if necessary."

Second, there is the question of conservation. Today its assign a /28 but tomorrow it could be assign a /24. If I want to actually have a /24 tomorrow then I need to assign a /28 ideally from an available block in area A that's exactly a /28 long. If none are availale, I'd prefer to break a /27 (still in area A) rather than a /26 or a /25. So now its, "Assign a /28 from the smallest available block in network area A to customer X. Assign and route a new superblock to area A if necessary."

But, see, I've been doing this for years now and customers come and go. Quite a few of the blocks assigned in my list may be dead; no longer associated with active customers. I don't want to go breaking larger blocks if there's an assigned but dead /28 I can grab. So now its, "Clean dead assignments from the list. Then assign a /28 from the smallest available block in network area A to customer X. Assign and route a new superblock to area A if necessary."

And lets not forget reverse-DNS. Ideally I want the customer to have some sort of control over it. So now its, "Clean dead assignments from the list. Then assign a /28 from the smallest available block in network area A to customer X. Assign and route a new superblock to area A if necessary. Delegate the reverse DNS for those IP addresses to the customer."

Needless to say, a spreadsheet is not very helpful for any of this. Finding that optimal /28 from network area A is like searching for a needle in a haystack. What I really need a system that:

A. Processes the cancelled customer list so it knows which assigned blocks are dead,
B. Find's the optimal /28 for me from area A for me, and
C. Sets up an appropriate delegation so the customer will be able to manage the reverse-DNS for his IP addresses but no others.

And no, I never did find a good system to do this. I used a flat file that could be used to generate a graphic representation of the assigned addresses and tagged all blocks to customer ids so I could automatically check them against the accounting system. It was better than excel but it wasn't good.

Re:Need more information

[IAN]

While I'm not managing more than a couple of /22s, that's still a lot of subnets, as we're mainly doling out /29 and /28 blocks. I've had all of parent's issues (minus router memory, so far), and I'm still doing fine with a spreadsheet.

What's the trick? Visualisation. Look at the image:

• Each row is a single allocation.
• Unallocated subnets have a light yellow background.
• The leftmost column (dark gray boxes) tracks /28s, and the second column (light gray) tracks /27s.

So, if a box occupies a single row, the corresponding allocation is of that size (cf. 160/27, 192/27 and 224/28.) If it spans multiple rows, the allocation is subdivided. With a little practice, it's quite obvious if there's a free subnet, what size it is, how easy would it be to expand etc.

DHCP, FTW!!!!

[ELiTeUI]

DHCP, FTW!!!!

Re:DHCP, FTW!!!!

[B'Trey]

DHCP is, in fact, irrelevant for this scenario as I understand it. He isn't assigning IPs to machines, which is what DHCP does. He's assigning blocks of IPs to other people for use as they see fit. The host using the IP might be sitting on the other side of two or three routers over which he has no control. It might not be assigned to a host or even a server. It might be assigned to a router interface. It might be assigned to a switches management VLAN. It might be one of a pool of IPs used in NATting a large number of hosts. Etc, etc, etc. The precise assignment of the IP is almost certainly not his responsibility and trying to track all of that additional info makes the job much harder, not easier. (Not to mention stepping on the toes of whomever he's assigning the IPs to. I know I'd be quite irritated if I had to go through my ISP to change where I"m using one of the IPs in my /30 block.) Anyone who suggests DHCP as an answer to this issue is either seriously misunderstanding the issue or has only cursory knowledge of the subject.

Uhhh...

[Talez]

Shouldn't your DHCP server have a list of its leases?

nmap & dhcp?

[khasim]

First off, just looking at your router configs should tell you what addresses are where.

Then, make sure you're using dhcp to assign the addresses.

Use nmap to check for weirdness.

Re:nmap & dhcp?

[Stephen Samuel]

The purpose of this tracking is to be able to specify the router configs, and having to talk to dozens of routers every time someone wants a block of IPs assigned is going to get onerous. That's why this person (and any sane person in a similar situation) would like a reasonably straightforward and central way of knowing what networks are (and can be) assigned where, and what the router configs should be.

Of course, after that I'd probably write a script to call up each router, compare their routing tables to what I think they should be an email me with any discrepancies.

IPplan

[yawble]

Hello 30 seconds on google:

http://iptrack.sourceforge.net/

Re:IPplan

[Anonymous Coward]

I've used IPplan in several instances to manage many thousands of addresses. Works well, will generate swips, DNS and DHCP config files, as well as running on most any platform.

Re:IPplan

[Builder]

I love it when someone asks for personal experience and advice, and someone else just points to some tool they found on google. No explanation of how good it is, no personal experience, but hey, I found it on Google so it must be good enough, right ?

Dynamic Host Configuration Protocol

[Colin Smith]

Imagine using spreadsheets these days.

On top of DHCP, add Dynamic DNS and you're almost all set. Just make sure to use a DHCP and DNS server from the same producer, they're generally not 100% compatible with one-another if you don't. They might be 99% but that 1% creates a whole world of trouble.

Re:If only...

[mikael]

What's wrong with DHCP and dynamically updated DNS?

You don't want users connecting their own systems onto the network whenever they feel like it. All PC's in our university have static IP's. And an alarm goes off whenever anyone as much as removes a single computer from the network. Even the cables from the router to the wall sockets are manually connected and disconnected. There are however, Wi-Fi areas for anyone who wishes to connect their laptops to the network, and users are free to use USB memory keys, CD/DVD burners and external drives.
Tech-support still have painful memories of when someone tried and failed to smuggle a PC out through the small bathroom windows in the block.

Managing IPs / DNS

[bernywork]

This question has come up once or twice before.

The usual suspects for answers to this question are as follows:

NorthStar, which is quite feature rich. "NorthStar is a system to help track and allocate blocks in an IP Network"

IPplan which is another open source product.

And PHPip

If you want to go commercial VitalQIP Enterprise could suit your needs quite well.

Berny

Re:Just like the average ask slashdot..

[sk8king]

What an annoying comment....perhaps a troll.

Asking slashdot is informative for everyone. Sure, google may turn up a few thousand hits, but there may still be some gems hidden in there that slashdot can provide links to.

Maybe people will find a new version/product that they didn't know they wanted/needed.

Network management

[Colin Smith]

Is there a simple way to list and view the IP addresses used on my network?" man fping. Though with 1000 nodes I'd be heading up to a network management system, something with autodiscovery. jffnms, opennms, zenoss or similar.

Ubersmith Datacetner Edition

[casualsax3]

My company has been using Ubersmith Datacenter Edition (Uber DE, for those in the know) for a few months now - the IP management stuff they've integrated into the device manager is pretty slick to say the least. We've done the spreadsheet before, as well as North*, but neither of those options mesh well with any external systems. If you've got hardware/network stuff to manage as well (which I assume you do) give the Ubersmith guys a call. I don't think there's an online demo of DE yet (lame) but when we were interested in the system we called up and one of the developers gave us a walkthrough of a live build, explaining what was going on. http://www.ubersmith.com/

Re:If only...

[Anonymous Coward]

A decent DHCP server can easily be configured not to hand out addresses to anything. It can be configured to only hand out an address (dynamic or static, take your pick) to only a specific MAC address (or addresses).

>And an alarm goes off whenever anyone as much as removes a single computer from the network.

That'd be quite a bit of overhead, what with pinging every single machine constantly to check it's state. No DHCP server I've seen would do that, but with the open source DHCP servers, it wouldn't be too tough to implement.

>Even the cables from the router to the wall sockets are manually connected and disconnected.

That's not at the layer DHCP operates at, so yeah, that's a problem only the switch it's connected to can handle.

>There are however, Wi-Fi areas for anyone who wishes to connect their laptops to the network, and users are free to use USB memory keys, CD/DVD burners and external drives.

Something else, obviously, DHCP is designed for.

Really, it's a great tool. I'd still recommend setting up DHCP to hand out addresses to machines that aren't listed in the MAC address database, but they should be handed out an address on a network that isn't reachable by anything but the DHCP server. Lets you know that the machine is connecting OK, and, if you have the machine configured to allow you to push software on to it (to lock it down / whatever) you'll still be able to do that.

Cheops-NG

[ET_Fleshy]

I like Cheops-ng, though I'm not sure if that's exactly what you're looking for. Also, I wouldn't run it during peak business hours -- don't wanna clog those tubes ;)

Previous Ask Slashdot discussion

[josath]

Maybe you can find some useful info here, this topic came up about a year ago:
http://ask.slashdot.org/article.pl?sid=06/04/26/22 51224

Using the right tool for the job

[Sloppy]

Previously, an Excel Spreadsheet has been sufficient enough for my needs

Awesome. By using a spreadsheet, you can "what if?" and see what would happen if you were to change a certain node's address, as the change instantly propogates through various calculations, ultimately altering that final cell either subtly, or drastically. You can even make a pie chart that shows the addresses!

But best of all, since it's not just a spreadsheet -- it's an Excel(TM) spreadsheet! -- you have the advantage of Microsoft's advanced proprietary technology. Pity the fool who has to settle for Lotus 1-2-3 to .. um .. record a list.

Re:Just like the average ask slashdot..

[Matt Perry]

"Hey, Slashdot, I don't know how to do my job.. please help me. I could PROBABLY google around for 30-40 seconds and find a solution, and earning my paycheck by doing so.. but I figure I'll waste everyone's time."

"Hey Slashdot, I'm good at my job but I don't know everything.. please help me. I've already googled around for at least an hour to see what solutions exist. Being a social and intelligent human being who doesn't live in a vacuum, I'd love to have a conversation with other administrators about what solutions they have found valuable. I'm hoping that I can learn something those who have already investigated these solutions. I want to learn from your experience and leave a public record on Slashdot for other people who might have the same need in the future."

Re:If only...

[zeugma-amp]

That works fine if you only have small systems where every box has one IP. What about the webservers where you are running 20-30 websites on a single box, or application servers with a similar number of unique IPs?

We've been dealing with spreadsheet hell at the company where I work for years now, and it is only getting worse. We've got huge multi-page spreadsheets with hundreds of nonroutable network subnets in them. Worst thing about this is that ultimately, the spreadsheets cannot really be trusted because there is no way to verify that each IP in the sheet is live, or even desired to still be reserved for a specific purpose, because over time, people leave, projects come and go, and networks change through mergers/acquisitions.

You also have the little fiefdoms to worry about where group X has control over a big bunch of IP address space, but because it is managed through MS-AD, it doesn't communicate with anything to help you to manage it, or at least the controlling organizations won't let you manage it from a global perspective.

Of the packages I've looked at in the open source world, IPPlan and Sauron seem to be just about good enough for the task, but neither one seems to be actively developed anymore.