Global IP and MAC Search
In version 6.9.0 of the ipfabric Python SDK a new ipf_global_search CLI tool was added.
After installing the package it can be run from the command line.
Requirements
Required environment variables exported (IPF_URL and IPF_TOKEN or IPF_USERNAME & IPF_PASSWORD) or a
.env file located in the current working directory or your home directory.
Installing rich will enable prettier output (pip install rich or pip install ipfabric[cli]).
Documentation
IPF Global Search Help
# ipf_global_search -h
usage: ipf_global_search.cmd [-h] [-f] [-r {ipv4,ipv6,mac}] [-b] [-c] [-s SNAPSHOT] [-v] [-j] [-R] address
Search all tables for an IPv4, IPv6, or MAC address. This does not include IPv4 or IPv6 Route tables as too many results would be returned.
positional arguments:
address IPv4, IPv6, or MAC address to search for.
optional arguments:
-h, --help show this help message and exit
-f, --full-scan Scan all tables not just default. It will take more time so it is recommended to use if first search could not locate anything.
-r {ipv4,ipv6,mac}, --regex {ipv4,ipv6,mac}
Perform a regex search instead of an exact match on the tables, please quote your regex.
-c, --count Print count of rows instead of the actual data.
-s SNAPSHOT, --snapshot SNAPSHOT
Snapshot to use which can be a UUID or one of ['last', 'prev', 'lastLocked']with or without `$` for *nix compatability.
-v, --verbose Verbose output will enable debugging and print all tables even if no data.
-j, --json Enable JSON output which will also print all tables even if no data.
-R, --rich-disable Disable rich formatting if installed. Useful for sending JSON output to jq.
-b, --break-on-match Breaks out of searching tables when the first match is found.
Tables are searched in the order as listed below. If Full Scan option is enabled then any other tables are printed after these results in no specific order.
Default Tables for IPv4 Search:
1. /tables/addressing/managed-devs
2. /tables/inventory/interfaces
3. /tables/addressing/hosts
4. /tables/addressing/arp
5. /tables/wireless/clients
6. /tables/inventory/phones
7. /tables/cloud/virtual-machines-interfaces
8. /tables/neighbors/unmanaged
9. /tables/interfaces/connectivity-matrix/unmanaged-neighbors/detail
10. /tables/routing/protocols/bgp/neighbors
11. /tables/routing/protocols/eigrp/neighbors
12. /tables/routing/protocols/is-is/neighbors
13. /tables/routing/protocols/ospf/neighbors
14. /tables/routing/protocols/rip/neighbors
Default Tables for IPv6 Search:
1. /tables/addressing/ipv6-managed-devs
2. /tables/addressing/ipv6-hosts
3. /tables/addressing/ipv6-neighbors
4. /tables/neighbors/unmanaged
5. /tables/interfaces/connectivity-matrix/unmanaged-neighbors/detail
6. /tables/cloud/virtual-machines-interfaces
7. /tables/routing/protocols/bgp/neighbors
8. /tables/routing/protocols/is-is/neighbors
9. /tables/routing/protocols/ospf-v3/neighbors
Default Tables for MAC Search:
1. /tables/addressing/managed-devs
2. /tables/addressing/ipv6-managed-devs
3. /tables/inventory/interfaces
4. /tables/addressing/hosts
5. /tables/addressing/ipv6-hosts
6. /tables/addressing/ipv6-neighbors
7. /tables/addressing/arp
8. /tables/cloud/virtual-machines-interfaces
9. /tables/addressing/mac
10. /tables/wireless/radio
Usage
Search tables for IP '10.77.255.8'.
# ipf_global_search 10.77.255.8
Technology — Addressing — Managed IP: "Managed IPv4 addresses"
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%2210.77.255.8%22%5D%7D%5D%7D%7D
[
{
"dnsReverseMatch": -1,
"vlanId": null,
"hostname": "L77R8-LEAF2",
"dnsHostnameMatch": -1,
"type": "primary",
"vrf": "default",
"mac": null,
"stateL2": "up",
"sn": "a4dff08",
"net": "10.77.255.8/32",
"intName": "Lo0",
"ip": "10.77.255.8",
"siteName": "L77",
"dnsName": null,
"stateL1": "up",
"id": "d92d287622ac0e9241bb1f9209aacb2c"
}
]
Inventory — Interfaces: "Interface Inventory"
...
If no results are found you can add the -f|--full-scan which will check all tables which will increase time.
However adding -b|--break-on-match will stop search after the first match is found.
Search tables for IP '5.6.7.8'.
# ipf_global_search 5.6.7.8
Address "5.6.7.8" not found in tables, try running with '-f|--full-scan' to query all tables.
# ipf_global_search 5.6.7.8 -f
Technology — Management — AAA: "AAA Servers"
https://demo1.us.ipfabric.io/technology/management/aaa/servers?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%225.6.7.8%22%5D%7D%2C%7B%22srcIp%22%3A%5B%22eq%22%2C%225.6.7.8%22%5D%7D%5D%7D%7D
[
{
"srcIp": null,
"hostname": "hwl-r1-13-HP-comware",
"type": "authen",
"cfgName": null,
"sn": "SG41F6L04V",
"port": 1920,
"protocol": "radius",
"intName": null,
"ip": "5.6.7.8",
"siteName": "HWLAB",
"dstHostname": null,
"srvGroupName": "radius",
"id": "18182363340"
}
]
Regex
For Windows you may be required to escape special characters (& \ < > ^ |) using a caret ^ ("^(10.0.0.1|192.168.0.1)$"
becomes "^^(10.0.0.1^|192.168.0.1)$").
Search for IPv4 regex like '10.77.255.\d$'.
# ipf_global_search -r ipv4 "10.77.255.\d$"
Technology — Addressing — Managed IP: "Managed IPv4 addresses"
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22reg%22%2C%2210.77.255.%5C%5Cd%24%22%5D%7D%5D%7D%7D
[
{
"dnsReverseMatch": -1,
"vlanId": null,
"hostname": "L77EXR1",
"dnsHostnameMatch": -1,
"type": "primary",
"vrf": "",
"mac": null,
"stateL2": "up",
"sn": "a4dff01",
"net": "10.77.255.1/32",
"intName": "Lo0",
"ip": "10.77.255.1",
"siteName": "L77",
"dnsName": null,
"stateL1": "up",
"id": "4b3cc351d6d47b0b6d86042cd8f62d9a"
},
...
Count
Search address and only return the count.
# ipf_global_search -r ipv4 "10.77.255.\d$" -c
Technology — Addressing — Managed IP: "Managed IPv4 addresses": 8
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22reg%22%2C%2210.77.255.%5C%5Cd%24%22%5D%7D%5D%7D%7D
# ipf_global_search 10.77.255.8 -c
Technology — Addressing — Managed IP: "Managed IPv4 addresses": 1
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%2210.77.255.8%22%5D%7D%5D%7D%7D
JSON Output
If using JSON output disable rich with the -R|--rich-disable flag prior to sending to jq.
Search for address '10.77.255.8' and return unformatted JSON piping to 'jq'.
# ipf_global_search 10.77.255.8 -j -R | jq '.[0]'
{
"data": [
{
"dnsReverseMatch": -1,
"vlanId": null,
"hostname": "L77R8-LEAF2",
"dnsHostnameMatch": -1,
"type": "primary",
"vrf": "default",
"mac": null,
"stateL2": "up",
"sn": "a4dff08",
"net": "10.77.255.8/32",
"intName": "Lo0",
"ip": "10.77.255.8",
"siteName": "L77",
"dnsName": null,
"stateL1": "up",
"id": "d92d287622ac0e9241bb1f9209aacb2c"
}
],
"path": "/tables/addressing/managed-devs",
"webPath": "/technology/addressing/managed-ip",
"url": "https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%2210.77.255.8%22%5D%7D%5D%7D%7D",
"menu": "Technology — Addressing — Managed IP: \"Managed IPv4 addresses\""
}