xomoxcc/networkmgmt repository overview

⁠WIP !!!

⁠networkmgmt — Network Management Toolkit

CLI tool and Python library for multi-vendor switch management and network topology discovery.

Quick links:

• Docker Hub⁠ — multi-arch image (amd64/arm64)
• PyPI⁠ — pip install networkmgmt
• GitHub⁠ — source, issues, CI

⁠Modules

⁠Supported Switch Vendors

⁠CLI Structure

networkmgmt is an orchestrator that dispatches to three sub-CLIs. Each sub-CLI can also be invoked directly:

⁠Installation

pip install .

Optional extras:

pip install networkmgmt[snmp]          # pysnmp: netgear (Smart Managed Pro) vendor
pip install networkmgmt[netgear-plus]  # netgear-tool: netgear_plus (Smart Managed Plus) vendor
pip install networkmgmt[discovery]     # scapy: ARP scan in networkmgmt-discover
pip install networkmgmt[all]           # everything above

⁠Network Topology Discovery

Discover local network topology via ARP scanning, reverse DNS, MAC vendor lookup, SNMP bridge tables, LLDP, optional nmap service detection, and traceroute. Outputs Mermaid flowcharts or JSON.

⁠CLI

# Basic discovery (auto-detect interface)
networkmgmt-discover -i eth0
# or: networkmgmt discover -i eth0

# With nmap service detection (requires root for ARP scan)
sudo networkmgmt-discover -i eth0 --nmap -o topology.md

# JSON output
networkmgmt-discover -i eth0 --format json -o topology.json

# Multi-subnet scan
networkmgmt-discover -i eth0,vlan100 -o multi.md

# SNMP L2 topology (query switch MAC tables), SNMPv2c per switch
networkmgmt-discover -i eth0 --switches 192.0.2.38:public,192.0.2.19

# SNMPv3 for every switch without :community (v2c entries can be mixed in)
networkmgmt-discover -i eth0 --switches 192.0.2.38,192.0.2.150,192.0.2.19:public \
    --snmp-user admin --snmp-auth-key 'AUTHPASS' --snmp-auth-protocol sha512

# LLDP-based topology
networkmgmt-discover -i eth0 --lldp-collect /tmp/lldp

# Manual topology + diagram style
networkmgmt-discover -i eth0 --topology 192.0.2.50:192.0.2.19:g3 -d hierarchical

# Traceroute to external targets
networkmgmt-discover -i eth0 -t 8.8.8.8,1.1.1.1
sudo networkmgmt-discover -i eth0 -t 192.0.2.0/24

⁠Discovery Options

⁠Python Library Usage (Discovery)

See the README on GitHub⁠.

⁠SNMP VLAN Dump

Dumps VLAN membership (tagged/untagged), PVIDs and link state per port from Q-BRIDGE-MIB capable switches (tested on Netgear S3300 stacks and GS108Tv2) as a terminal table, Markdown or Mermaid diagram.

# SNMPv2c
networkmgmt vlan-dump 192.0.2.38 public
networkmgmt vlan-dump 192.0.2.38 public -m -o s3300.md -d trunks

# SNMPv3 (defaults sha512/aes128; authNoPriv when --snmp-priv-key is missing)
networkmgmt vlan-dump 192.0.2.38 --snmp-user admin --snmp-auth-key 'AUTHPASS'

# GS108Tv2: the web login is the SNMPv3 user, md5/sha + des only
networkmgmt vlan-dump 192.0.2.150 --snmp-user admin --snmp-auth-key 'WEBPASS' \
    --snmp-auth-protocol sha --snmp-priv-key 'WEBPASS' --snmp-priv-protocol des

SNMP_AUTH_KEY='AUTHPASS' networkmgmt vlan-dump 192.0.2.38 --snmp-user admin --snmp-timeout 10 --snmp-retries 2

• Factory VLANs (1, 2 Voice, 3 Auto-Video on the GS108Tv2) are missing from dot1qVlanStaticTable; the dump merges them in from dot1qVlanCurrentTable, static entries win.
• Stack links (S3300) show up in the VLAN 1 bitmap but are not bridge ports; they are listed in a note line and left out of tables and diagrams.
• A wrong user or key is reported as SNMP authentication failed. With SNMPv3 this often surfaces only as a timeout, so the message names user, auth and privacy settings as the likely cause.

⁠Switch Management CLI

networkmgmt-switchctrl --vendor <VENDOR> --host <IP> --password <PW> [options] <command>
# or: networkmgmt switchctrl --vendor <VENDOR> --host <IP> --password <PW> [options] <command>

⁠Global Options

⁠Commands

⁠Vendor Options

All options are command-line flags; each is rejected for vendors it does not belong to.

⁠monitor — Show system info, sensors, ports, and LACP status

Sections a vendor does not implement (Netgear sensors, LACP on netgear_plus) are reported as not supported and skipped; the rest is still printed.

# Cisco Catalyst 1200
networkmgmt-switchctrl --vendor cisco --host 192.168.1.254 \
    --username admin --password <PW> --enable-password <EN> monitor

# QNAP QSW
networkmgmt-switchctrl --vendor qnap --host 192.168.1.1 --password <PW> monitor

# Netgear Smart Managed Pro, SNMPv3 (S3300: sha512 + aes128 are the defaults)
networkmgmt-switchctrl --vendor netgear --host 192.168.1.38 --snmp-user monitor \
    --auth-key <AUTH> --priv-key <PRIV> monitor

# Netgear GS108Tv2: web login is the SNMPv3 user, md5/sha + des only
networkmgmt-switchctrl --vendor netgear --host 192.168.1.150 --snmp-user admin \
    --auth-key <WEBPW> --auth-protocol sha --priv-key <WEBPW> --priv-protocol des monitor

# Netgear, SNMPv2c
networkmgmt-switchctrl --vendor netgear --host 192.168.1.38 --community public vlan list

# Netgear Smart Managed Plus
networkmgmt-switchctrl --vendor netgear_plus --host 192.168.1.5 --password <PW> vlan list

⁠vlan — VLAN management

# Create VLAN
networkmgmt-switchctrl --vendor cisco --host 192.168.1.254 \
    --username admin --password <PW> --enable-password <EN> \
    vlan create 100 --name servers

# List VLANs
networkmgmt-switchctrl --vendor cisco ... vlan list

# Delete VLAN
networkmgmt-switchctrl --vendor cisco ... vlan delete 100

⁠port — Port configuration

# Configure port (Cisco uses gi1-gi8, QNAP uses GigabitEthernet1/0/1)
networkmgmt-switchctrl --vendor cisco --host 192.168.1.254 \
    --username admin --password <PW> --enable-password <EN> \
    port config gi1 --speed 1000 --duplex full

# Disable a port
networkmgmt-switchctrl --vendor cisco ... port config gi3 --shutdown

⁠example — Quick connectivity test

networkmgmt-switchctrl --vendor cisco --host 192.168.1.254 \
    --username admin --password <PW> --enable-password <EN> example

⁠Python Library Usage (Switch Management)

See the README on GitHub⁠.

⁠Vendor-Specific Notes

⁠Cisco Catalyst 1200 (C1200-8T-D)

• SSH only — no REST API available
• Port names: gi1 through gi8 (not GigabitEthernet1/0/1)
• Enable password required — no auto-generation, C1200 enforces password change on first login
• VLAN creation uses vlan database mode (not configure terminal > vlan {id})
• LACP uses channel-group {id} mode auto (not mode active)
• Fanless — PoE-powered, get_sensor_data() always returns fan_speed=0

⁠QNAP QSW

• Dual transport — REST API for monitoring and VLANs, SSH (Cisco-style CLI) for port/LACP configuration
• VLAN backend — REST by default (vlan_backend="rest"); SSH if ssh_username, ssh_password or enable_password is given (or vlan_backend="ssh")
• Serialised REST — rest_delay (default 0.3 s) between requests
• Enable password can be auto-generated from the switch serial number
• Default SSH credentials: guest / guest123
• No PVID — the untagged membership is the native/access VLAN, so at most one per port

⁠Netgear Smart Managed Pro (netgear)

• SNMP — SNMPv3 (snmp_user, auth_key, priv_key) preferred, SNMPv2c (community) as fallback; needs pysnmp (networkmgmt[snmp])
• Models — S3300 stack, GS108Tv2, M4300 class; port names are <unit>/g<n>
• Managers — VLAN incl. PVID, port admin state, LAG read-only, stack units/ports; sensors and LAG changes raise NotImplementedError
• switch.routing — VLAN routing interfaces, management IP/gateway and static routes; static routes need web_password (web UI)
• switch.save_config() — writes are running-config only until saved
• Writes are verified — every write is polled until the read-back shows it

⁠Netgear Smart Managed Plus (netgear_plus)

• Web UI via the optional netgear-tool package (networkmgmt[netgear-plus]); single web session, use the client as a context manager
• Models — GS105E, GS108E, GS305E; ports are 1-based numbers
• VLAN — declarative switch.vlan.reconcile(...) (create, edit, PVID, delete, read-back check), ensure_vlan, ensure_vlan_absent, ensure_port_vlans
• 802.1Q mode must be enabled on the switch; no LACP, no sensors (NotImplementedError)

⁠MikroTik

• Dual transport — REST API (RouterOS v7+) for monitoring, SSH for configuration
• No enable mode — RouterOS uses direct admin access

⁠Hardware quirks

• GS108T SNMPv3 — the user is the web login (admin, auth key = web password) and only md5/sha with des work.
• Delayed writes — SNMP and REST writes take effect with delay, so every write is verified by polling the read-back.
• One varbind per PDU — VLAN writes on Netgear Pro are sent as single-varbind SETs; bundled varbinds are rejected with commitFailed.
• Factory VLANs — Netgear Pro lists default VLANs only in the Q-BRIDGE current table, not in the static table.
• Untagged mask — patch the Netgear Pro untagged port list bit by bit; clearing the CPU-port bit (13 on the GS108T) blocks every later untagged change of that VLAN, cleared bits of regular ports are harmless.
• Stack links — Netgear Pro stack ports are not bridge ports and are rejected as VLAN members.
• Save — Netgear Pro persists the config via agentSaveConfig under 4526.11 (not 4526.10).
• Static routes — Netgear Pro accepts them only through the web UI (SNMP writes fail with commitFailed), which allows at most 4 sessions.
• Plus VLANs — untagged also sets the PVID, and 802.1Q mode must be on.
• QNAP backend — bursts of REST requests crash the switch backend (fork ENOMEM), so requests are serialised; avoid lldp/neighbors/status; there is no PVID.

⁠Ansible modules

The ansible/ directory contains stand-alone Ansible modules (no collection packaging) for Netgear Smart Managed Plus and Pro switches and QNAP QSW switches. They encode the same hardware findings as networkmgmt.switchctrl, but target playbooks: declarative, idempotent, with check mode and diff. See ansible/README.md⁠.

⁠Architecture

See the README on GitHub⁠.

⁠Adding a New Vendor

See the README on GitHub⁠.

⁠License

This project is licensed under the LGPL where applicable/possible — see LICENSE.md⁠. Some files/parts may use other licenses: MIT⁠ | GPL⁠ | LGPL⁠. Always check per‑file headers/comments.

⁠Authors

• Repo owner (primary author)
• Additional attributions are noted inline in code comments

⁠Acknowledgments

• Inspirations and snippets are referenced in code comments where appropriate.

⁠⚠️ Note

This is a development/experimental project. For production use, review security settings, customize configurations, and test thoroughly in your environment. Provided "as is" without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software. Use at your own risk.