keep historical mac connected device?

[j. herrera]

Hello,

is it possible with switchmap to keep and track down mac addresses that were connected to a port that is now inactive?? it would be very useful to me i.e search and find where a given mac address was connected yesterday or a week ago, but now is not showing.

is switchmap keeping historical data somehow???

Thank you very much,

[Andrew]

This is one downside I've had with switchmap too. At first the way I dealt with it was to use rsnapshot to keep daily backups of the www folder and then use grep to search the historical data. It's not elegant but works to some degree. However, since then I've found a free product designed just for keeping historical port data and I've been using that ever since with great sucess. It is called the Network Tracking Database (NetDB). There is a VMware Ubuntu image for it to get you up and running very fast if you don't want to mess with installing it. I now use both switchmap mainly to keep track of unused ports and then NetDB to find devices on my network and see their historical movement across switchports.

http://netdbtracking.sourceforge.net/

[j. herrera]

Thank you for the tip, Andrew...i'll give NetDB a try...IMHO to have devices historical data is almost a must, given most of the time what you need is to solve some kind of "forensic" issue or do some device port connectivity troubleshooting....all the info we can get is always welcome...

Thank you very much again,