hermes-skills/devops/infrastructure-recon/references/proxmox-ct-vm-parsing.md

Proxmox Config File Parsing for Inventory Mapping

LXC Containers (/etc/pve/lxc/<CTID>.conf)

Key fields to extract:

• hostname: <name> — container hostname
• memory: <MB> — RAM allocation
• cores: <N> — CPU cores
• net0: ... ip=<IP> or ip=dhcp — network config (may be multiple net lines)

Static IP parsing

grep -E '^net[0-9]+:' /etc/pve/lxc/135.conf | grep 'ip='
# → net0: ... ip=10.0.30.102/24,...

DHCP mapping

DHCP-assigned CTs do not show an IP in the config. Match by:

• Hostname from config → runtime hostname collected via SSH
• MAC address (hwaddr=) from config → ARP table lookup
• Or query Proxmox API: pvesh get /nodes/<node>/lxc/<vmid>/config

QEMU VMs (/etc/pve/qemu-server/<VMID>.conf)

• name: <name> — VM name
• net0: ... bridge=vmbr0,tag=<VLAN> — network (usually DHCP, no static IP in config)

VM IPs are typically assigned by DHCP. To discover:

# From Proxmox node
arp -a | grep <MAC>
# Or via API
pvesh get /nodes/<node>/qemu/<vmid>/agent/network-get-interfaces

Cross-referencing SSH inventory with Proxmox configs

1. Collect all CT configs → map CTID → hostname → config_ip
2. Collect all VM configs → map VMID → name → VLAN
3. For each accessible SSH host:
   • Match hostname against CT/VM hostname
   • If match found → assign CT/VM ID
   • If no match → mark as "unknown CT/VM or bare metal"
4. Flag CTs/VMs in range that were NOT accessible (potential gap in scan)

Proxmox API alternative

If SSH to Proxmox node is available but direct file parsing is messy:

pvesh get /cluster/resources --output-format json | jq '.[] | select(.type=="lxc" or .type=="qemu") | {id, name, status, node}'