Monitoring the network

Bart Silverstrim bsilver at chrononomicon.com
Mon Jan 26 13:20:31 UTC 2009


Might be related to the MAC addresses thread question...but I'm hoping 
there are some scripting gurus that have done this.

If I have a range of IPs that I *know* should be populated by particular 
machines, but there are gaps in the IP range that are designated "to be 
filled" and I want to watch to make sure nothing "appears" in them is 
there a way to have my Ubuntu machine watch and notify me if activity 
appears on those IP's that should be empty but aren't, preferably by email?

Ideally I could have a text file of IP's and machine names, or at least 
IP's in that range that should be full so that if something appeared as 
activity on other addresses they'd be flagged and I'd be emailed that "a 
machine named $HOSTNAME was found on $IP with MAC address of $MAC"

Is there a simple script or application that can do something like this? 
I know it wouldn't be comprehensive since my computer isn't a gateway 
and seeing ALL traffic but I'm thinking it should see, or chances are 
would see, traffic from ARP "who has" requests or something similar on a 
windows network, and at least be another layer of monitoring.

This might also be useful to other admins out there.

-Bart




More information about the ubuntu-users mailing list