Lopes Logbook

Automating Network Management with NetBox Scanner

· 4min · Joe Lopes
Illustration of a cyberpunk robot with spiders.

Back in 2018, I was leading the SOC and NOC teams and although I'm not an excellent network engineer, I always tried to help technically the networking team. On that year we were struggling with the IPAM tool and started looking for a replacement. Then we found and tested NetBox, an open-source IPAM from DigitalOcean, and put that into production.

The main concern the NOC had about IPAM is that this tool can be outdated very fast, so I decided to write a tool to automatically discover and update certain subnets. This led to the netbox-scanner creation and when finished, this software scanned daily more than 50 subnets, some of them a /21, which resulted in lots of hosts registered and managed automatically.

As the company changed, I left the position of NOC leader focusing on SOC. So the netbox-scanner was forgotten by both teams although some people were still using it --source code was available on GitHub. Despite continually receiving issues and pull-requests, I had no time to improve that code, so I neglected all requests. It last until May 2020, when I decided to use some spare time due to COVID-19, to create a brand new version of that script.

At first, I planned the new version, focusing on a modular environment, and documented this in a new issue. After that, I started the repository cleaning process, reviewing all issues for some ideas that could have been added to the project --the feature to use the configuration file from two possible directories was born here.

When the technical part began, I thought it would take at least one month to finish the job since I hadn't been coding for almost 6 months, and I still had my full-time job, so I would code only when idle. To my surprise, all the concepts were fresh in my mind, so I was able to finish the job in only three days, which made me really happy!

Despite this project is not directly secure-related, it was very good to learn or improve some techniques:

  • Logging: Using logging to record actions and enable further tracking, good for fully automated scans.
  • Argument parsing: One of the best ways to catch user interactions is directly from the command line.
  • Config files processing: Although the CLI is good, when there are many options, it is easier to use configuration files.
  • XML processing: Either XML and JSON are excellent standards for interoperability and it is always good to not reinvent the wheel.
  • API usage: NetBox has a good API, the pynetbox, and it implements all actions I needed albeit the documentation is not good.
  • API creation: Since I decided to create an integration with Cisco Prime and couldn't find a Python API, I had to create my own --in this case, I used the one I wrote in 2019.
  • Testing: Automated tests improve the development lifecycle and enable CI/CD/DevOps functions --automated tests should include some security tests too, see DevSecOps.
  • Git features: Git is the best software I know for version control and here I had the opportunity to use some features I had never used --branch and merge.

All in all, it was fun and very satisfying to upgrade the netbox-scanner version, and consequently, I learned a lot of things. I think this is the core concept of free software when you use something and is able to contribute to that.

Let's move to the next objectives!