Monitoring the network
bsilver at chrononomicon.com
Mon Jan 26 13:20:31 UTC 2009
Might be related to the MAC addresses thread question...but I'm hoping
there are some scripting gurus that have done this.
If I have a range of IPs that I *know* should be populated by particular
machines, but there are gaps in the IP range that are designated "to be
filled" and I want to watch to make sure nothing "appears" in them is
there a way to have my Ubuntu machine watch and notify me if activity
appears on those IP's that should be empty but aren't, preferably by email?
Ideally I could have a text file of IP's and machine names, or at least
IP's in that range that should be full so that if something appeared as
activity on other addresses they'd be flagged and I'd be emailed that "a
machine named $HOSTNAME was found on $IP with MAC address of $MAC"
Is there a simple script or application that can do something like this?
I know it wouldn't be comprehensive since my computer isn't a gateway
and seeing ALL traffic but I'm thinking it should see, or chances are
would see, traffic from ARP "who has" requests or something similar on a
windows network, and at least be another layer of monitoring.
This might also be useful to other admins out there.
More information about the ubuntu-users