Skip to content

Global IP and MAC Search

In version 6.9.0 of the ipfabric Python SDK a new ipf_global_search CLI tool was added. After installing the package it can be run from the command line.

Requirements

Required environment variables exported (IPF_URL and IPF_TOKEN or IPF_USERNAME & IPF_PASSWORD) or a .env file located in the current working directory or your home directory.

Installing rich will enable prettier output (pip install rich or pip install ipfabric[cli]).

Documentation

IPF Global Search Help
# ipf_global_search -h
usage: ipf_global_search [-h] [-f] [-r {ipv4,ipv6,mac}] [-B] [-s SNAPSHOT] [-b BASE_URL] [-t TOKEN] [-u USERNAME] [-p PASSWORD] [-c] [-v] [-j] [-R] address

Search all tables for an IPv4, IPv6, or MAC address. This does not include IPv4 or IPv6 Route tables as too many results would be returned.

positional arguments:
  address               IPv4, IPv6, or MAC address to search for.

optional arguments:
  -h, --help            show this help message and exit
  -f, --full-scan       Scan all tables not just default.  It will take more time so it is recommended to use if first search could not locate anything.
  -r {ipv4,ipv6,mac}, --regex {ipv4,ipv6,mac}
                        Perform a regex search instead of an exact match on the tables, please quote your regex.
  -B, --break-on-match  Breaks out of searching tables when the first match is found.
  -s SNAPSHOT, --snapshot SNAPSHOT
                        Snapshot to use which can be a UUID or one of ['last', 'prev', 'lastLocked']with or without `$` for *nix compatability.
  -b BASE_URL, --base-url BASE_URL
                        Base URL for IPFabric API or IPF_URL env variable.
  -t TOKEN, --token TOKEN
                        IP Fabric API Token or IPF_TOKEN env variable.
  -u USERNAME, --username USERNAME
                        IP Fabric username (requires --password) or IPF_USERNAME env variable.
  -p PASSWORD, --password PASSWORD
                        IP Fabric password or IPF_PASSWORD env variable.
  -c, --count           Print count of rows instead of the actual data.
  -v, --verbose         Verbose output will enable debugging and print all tables even if no data.
  -j, --json            Enable JSON output which will also print all tables even if no data.
  -R, --rich-disable    Disable rich formatting if installed. Useful for sending JSON output to jq.
Tables are searched in the order as listed below. If Full Scan option is enabled then any other tables are printed after these results in no specific order.
Default Tables for IPv4 Search:
1. /tables/addressing/managed-devs
2. /tables/inventory/interfaces
3. /tables/addressing/hosts
4. /tables/addressing/arp
5. /tables/wireless/clients
6. /tables/inventory/phones
7. /tables/cloud/virtual-machines-interfaces
8. /tables/neighbors/unmanaged
9. /tables/interfaces/connectivity-matrix/unmanaged-neighbors/detail
10. /tables/routing/protocols/bgp/neighbors
11. /tables/routing/protocols/eigrp/neighbors
12. /tables/routing/protocols/is-is/neighbors
13. /tables/routing/protocols/ospf/neighbors
14. /tables/routing/protocols/rip/neighbors

Default Tables for IPv6 Search:
1. /tables/addressing/ipv6-managed-devs
2. /tables/addressing/ipv6-hosts
3. /tables/addressing/ipv6-neighbors
4. /tables/neighbors/unmanaged
5. /tables/interfaces/connectivity-matrix/unmanaged-neighbors/detail
6. /tables/cloud/virtual-machines-interfaces
7. /tables/routing/protocols/bgp/neighbors
8. /tables/routing/protocols/is-is/neighbors
9. /tables/routing/protocols/ospf-v3/neighbors

Default Tables for MAC Search:
1. /tables/addressing/managed-devs
2. /tables/addressing/ipv6-managed-devs
3. /tables/inventory/interfaces
4. /tables/addressing/hosts
5. /tables/addressing/ipv6-hosts
6. /tables/addressing/ipv6-neighbors
7. /tables/addressing/arp
8. /tables/cloud/virtual-machines-interfaces
9. /tables/addressing/mac
10. /tables/wireless/radio

Usage

Search tables for IP '10.77.255.8'.
# ipf_global_search 10.77.255.8

Technology  Addressing  Managed IP: "Managed IPv4 addresses"
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%2210.77.255.8%22%5D%7D%5D%7D%7D
[
    {
        "dnsReverseMatch": -1,
        "vlanId": null,
        "hostname": "L77R8-LEAF2",
        "dnsHostnameMatch": -1,
        "type": "primary",
        "vrf": "default",
        "mac": null,
        "stateL2": "up",
        "sn": "a4dff08",
        "net": "10.77.255.8/32",
        "intName": "Lo0",
        "ip": "10.77.255.8",
        "siteName": "L77",
        "dnsName": null,
        "stateL1": "up",
        "id": "d92d287622ac0e9241bb1f9209aacb2c"
    }
]

Inventory  Interfaces: "Interface Inventory"
...

If no results are found you can add the -f|--full-scan which will check all tables which will increase time. However adding -B|--break-on-match will stop search after the first match is found.

Search tables for IP '5.6.7.8'.
# ipf_global_search 5.6.7.8

Address "5.6.7.8" not found in tables, try running with '-f|--full-scan' to query all tables.

# ipf_global_search 5.6.7.8 -f

Technology  Management  AAA: "AAA Servers"
https://demo1.us.ipfabric.io/technology/management/aaa/servers?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%225.6.7.8%22%5D%7D%2C%7B%22srcIp%22%3A%5B%22eq%22%2C%225.6.7.8%22%5D%7D%5D%7D%7D
[
    {
        "srcIp": null,
        "hostname": "hwl-r1-13-HP-comware",
        "type": "authen",
        "cfgName": null,
        "sn": "SG41F6L04V",
        "port": 1920,
        "protocol": "radius",
        "intName": null,
        "ip": "5.6.7.8",
        "siteName": "HWLAB",
        "dstHostname": null,
        "srvGroupName": "radius",
        "id": "18182363340"
    }
]

Regex

For Windows you may be required to escape special characters (& \ < > ^ |) using a caret ^ ("^(10.0.0.1|192.168.0.1)$" becomes "^^(10.0.0.1^|192.168.0.1)$").

Search for IPv4 regex like '10.77.255.\d$'.
# ipf_global_search -r ipv4 "10.77.255.\d$"

Technology  Addressing  Managed IP: "Managed IPv4 addresses"
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22reg%22%2C%2210.77.255.%5C%5Cd%24%22%5D%7D%5D%7D%7D
[
    {
        "dnsReverseMatch": -1,
        "vlanId": null,
        "hostname": "L77EXR1",
        "dnsHostnameMatch": -1,
        "type": "primary",
        "vrf": "",
        "mac": null,
        "stateL2": "up",
        "sn": "a4dff01",
        "net": "10.77.255.1/32",
        "intName": "Lo0",
        "ip": "10.77.255.1",
        "siteName": "L77",
        "dnsName": null,
        "stateL1": "up",
        "id": "4b3cc351d6d47b0b6d86042cd8f62d9a"
    },
...

Count

Search address and only return the count.
# ipf_global_search -r ipv4 "10.77.255.\d$" -c

Technology  Addressing  Managed IP: "Managed IPv4 addresses": 8
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22reg%22%2C%2210.77.255.%5C%5Cd%24%22%5D%7D%5D%7D%7D

# ipf_global_search 10.77.255.8 -c

Technology  Addressing  Managed IP: "Managed IPv4 addresses": 1
https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%2210.77.255.8%22%5D%7D%5D%7D%7D

JSON Output

If using JSON output disable rich with the -R|--rich-disable flag prior to sending to jq.

Search for address '10.77.255.8' and return unformatted JSON piping to 'jq'.
# ipf_global_search 10.77.255.8 -j -R | jq '.[0]'
{
  "data": [
    {
      "dnsReverseMatch": -1,
      "vlanId": null,
      "hostname": "L77R8-LEAF2",
      "dnsHostnameMatch": -1,
      "type": "primary",
      "vrf": "default",
      "mac": null,
      "stateL2": "up",
      "sn": "a4dff08",
      "net": "10.77.255.8/32",
      "intName": "Lo0",
      "ip": "10.77.255.8",
      "siteName": "L77",
      "dnsName": null,
      "stateL1": "up",
      "id": "d92d287622ac0e9241bb1f9209aacb2c"
    }
  ],
  "path": "/tables/addressing/managed-devs",
  "webPath": "/technology/addressing/managed-ip",
  "url": "https://demo1.us.ipfabric.io/technology/addressing/managed-ip?options=%7B%22filters%22%3A%7B%22or%22%3A%5B%7B%22ip%22%3A%5B%22eq%22%2C%2210.77.255.8%22%5D%7D%5D%7D%7D",
  "menu": "Technology — Addressing — Managed IP: \"Managed IPv4 addresses\""
}