I am routinely surprised (and frankly a little disappointed) to see posts in the DW System Storage forum from end users reporting they cannot manage their storage devices, because they don't know the assigned IP addresses. This situation often arises due to:
- Changes in personnel
- Poor or missing documentation
- Ignorance of where critical information is kept.
But of course there are times when you don't know a devices IP address for the very simple reason that it arrived that way....
Yesterday I helped a colleague set up an old DS4500 storage device (as part of a more exciting Power7 demonstration he is setting up). The DS4500 came out of our demonstration machine pool and it was not set to the default IP addresses (where controller A is 192.168.128.101 and controller B is 192.168.128.102). Nor was there any accompanying documentation detailing what the IP addresses had been set to... not good.
So we had two choices:
- Connect to the serial port and display the IP addresses using the netCfgShow command
- Use WireShark to try and sniff out the IP addresses
Wireshark is the follow-on product to a previous piece of software called Ethereal. Wireshark is Open Source Software released under the GNU General Public License. It is free to download and install and is a very handy network sniffing tool.
After installing Wireshark on my laptop I selected Interfaces from the the Capture drop down:
From the Capture menu, you will get a list of interfaces. In my case I selected the Start option next to my ethernet interface:
I then attached an ethernet cable between my laptop ethernet port and the ethernet port of the DS4500.
I didn't use a cross-over ethernet cable, as my laptop ethernet port is auto-MDIX (which most ethernet ports are now).
I also didn't set any IP address on my laptop (as there is no point since we didn't know what IP address the DS4500 was using).
What I then looked for in the trace is one of two things.
- Gratuitous ARP requests, where the device is trying to alert other devices to its IP and MAC address and prevent IP address conflicts
- ARP who has requests used to try and detect if anyone else is using a specific IP address.
The other handy trick is that Wireshark is smart enough to decode the manufacturer OID to detect who made the device.
In the first example below, the bottom line gives me the answer I am looking for.
The manufacturer is Symbios, an early brand name used by the original manufacturer of the DS4500 (now owned by LSI).
It is sending a broadcast regarding 10.5.16.6.
So in this case my DS4500 is using IP address 10.5.15.6.
I repeated the exercise with controller B (which unsurprisingly was 10.5.15.7) and then set my laptop to 10.5.15.100 (so I was in the same subnet) and was able to communicate with the DS4500 and complete the setup stage.
This second example is from a Brocade SAN switch. I did this just to prove this process works with other devices.
Because this one is from my own internal lab, I have obscured the IP addresses. But the IP address on the right hand side is the source IP address which is the one I would be attempting to learn. The hint is that it is saying 'Tell 9.185.x.x' which clearly indicates thats who it is. Again Wireshark is smart enough to even tell me the attached device is a Brocade device. I also successfully tried this on a Cisco MDS switch.