Node names NetBIOS

Node names and NetBIOS

Netdisco will allow you to locate a node using its FQDN (node123.foo.org) or its NetBIOS name (NODE123).

This functionality requires that Netdisco is able to obtain the MAC address <> IP address data from your network. Normally this is obtained by polling your router for arp cache information.

If you do not have your router monitored by netdisco, the NetBIOS inventory (Reports > Node > NetBIOS inventory) and hostname search results will be limited to a very reduced set -- the machines that the netbios server has entries for in its local arp cache.

If monitoring your router is not possible in your deployment, it is possible to configure the Netdisco server to obtain this information itself.

These instructions were written for a CentOS system, but there is nothing distribution-specific about the process.

It should be stressed that this is not an optimal configuration - if possible, you should aim to pull this data from your router.

Set up SSH ARP collection

Note that in older versions of Netdisco, a separate netdisco-sshcollector binary was used. This is no longer the case, see sshcollector-Deprecation for details.

Nowadays, the Netdisco driver:cli setting in device_auth allows Netdisco to collect ARP data from devices without full SNMP support.

device_auth documentation

Any Linux device could be used to collect the ARP data, but using the Netdisco server seemed like the easiest option. SSH public key authentication was used to avoid storing passwords in plaintext config files.

Configuring SSH public key authentication for netdisco user

[netdisco@server ~/.ssh]$ ssh-keygen
[netdisco@server ~/.ssh]$ cat id_rsa.pub >> ~/.ssh/authorized_keys
[netdisco@server ~/.ssh]$ chmod og-wx ~/.ssh/authorized_keys
# If the authorized keys has write permissions, OpenSSH won't allow it to be used
[netdisco@server ~/.ssh]$ chmod 700 ~/.ssh/
# same goes for the ~/.ssh directory
[netdisco@server ~/.ssh]$ sudo systemctl restart sshd.service
[netdisco@server ~/.ssh]$ ssh netdisco@localhost
# If it establishes an SSH connection without asking for a password, you're in business!

Configuring SSH collector

# edit netdisco configuration file ~/environments/deployment.yml
device_auth:
  - tag: sshcollector
    only: localhost
    user: netdisco
    password: either put a password here or use the ssh_master_opts to specify a private key
    platform: Linux

You might need to add localhost as a pseudo device in the admin UI if this it is not discovered in the Netdisco database yet.

Make the server aware of all the addresses on your network.

By default the machine's arp cache will only contain entries for systems that it's communicated with, so we need to make it attempt to communicate with all your systems. An easy way to do this is to use nmap to do a ping scan of your entire subnet. Note that the --send-ip option is required.

[netdisco@server ~]$ sudo yum install nmap
[netdisco@server ~]$ nmap -sP 192.168.0.1/24 -n --send-ip 

# Now check that the arp cache has the expected number of entries
[netdisco@server ~]$ arp -an | wc -l

# It probably doesn't, because there's a default limit to the cache size, so you need to increase that...

Increase the system's arp cache size

Linux: Neighbour Table Overflow Error and Solution

For a CentOS system, append the following to /etc/sysctl.conf (note that these values may need to be adjusted depending on the size of your network.)

## works best with <= 500 client computers ##
# Force gc to clean-up quickly
net.ipv4.neigh.default.gc_interval = 3600
 
# Set ARP cache entry timeout
net.ipv4.neigh.default.gc_stale_time = 3600
 
# Setup DNS threshold for arp 
net.ipv4.neigh.default.gc_thresh3 = 4096
net.ipv4.neigh.default.gc_thresh2 = 2048
net.ipv4.neigh.default.gc_thresh1 = 1024

Load the changes with sudo sysctl -p

Verify

[netdisco@server ~]$ nmap -sP 192.168.0.1/24 -n --send-ip
[netdisco@server ~]$ arp -an | wc -l

# Now running an Arpnip job in the UI should collect these entries

The Reports > Node > NetBIOS inventory should now be properly populated, and hostname search should work as expected.

Schedule

You need to set up a cron schedule to run he nmap scan so that it roughly repopulates the arp cache around the time the arpnip job is run from schedule.