Monitor dhcp for unknown mac addresses

targettl · 10-25-2009, 07:25 AM

I am using Ubuntu Server and would like to recieve an email once a day listing mac address's that have requested an ip address that are not in my list of known mac address's.

#!/bin/sh
mac=`grep DHCPREQUEST /var/log/syslog | cut -c 77-94`
#shows all macs that have requested an ip
#this will produce something like
#mac1
#mac2
#mac3

lookup=`grep $mac /root/dhcp.macs`
#This does not work as the first entry mac1 will be okay but mac2 and mac3 will not
#It will try to use mac2 as the file to look in which won't exist
#I need to make it loop through for each line of the variable and add that to the lookup value

diff $mac $lookup
#I think this should differentiate known from unknown if i can get a lookup value

ilikejam · 10-25-2009, 11:30 AM

Hi.

I'd sort the two MAC lists, then use 'comm' to find MACs in syslog that aren't in /root/dhcp.macs .

Something like:

Code:

sort /root/dhcp.macs > /tmp/dhcp.macs.sort
grep DHCPREQUEST /var/log/syslog | cut -c 77-94 | sort > /tmp/syslog.macs.sort
comm -3 /tmp/dhcp.macs.sort /tmp/syslog.macs.sort
rm -f /tmp/syslog.macs.sort /tmp/dhcp.macs.sort

Dave

targettl · 10-26-2009, 12:19 AM

Why are you sorting the files?
Is it because for the comm command to work entries have to be on the same line.
If so this will not work as not all clients will request dhcp and then stuff will be on different lines.

Any other commands that compare files?
If one file contain a mac address that the other doesn't it will show up and that will have to work if they are in different locations of the file

targettl · 10-26-2009, 12:40 AM

file1 file2
mac1 mac3
mac2 mac4
mac3 mac8
mac4 mac9

I would like a command that would compare each line in file2 with file1 or vise versa and output the lines that are not found in the comparison file. In this example mac8 and mac9 should be displayed as there is no entry on any line of file1 for these.

targettl · 10-26-2009, 02:47 AM

Here is my solution tested and works

#!/bin/sh

#shows macs that have requested an ip
grep DHCPREQUEST /var/log/syslog | cut -c 77-94 > /root/todaysrequests

#looks up to see if a mac address is known and places in a file if it isn't
grep -v -f /root/dhcp.macs /root/todaysrequests > /root/unknownaddress

/usr/bin/mail -s "DHCP Security" "admin@domain" < /root/unknownaddresses

ilikejam · 10-26-2009, 06:08 AM

Hi again.

'comm' only works on sorted lists. The MACs should actually be run through 'uniq' too.
The following does exactly what you're looking for, as far as I can see:

Code:

sort /root/dhcp.macs | uniq > /tmp/dhcp.macs.sort
grep DHCPREQUEST /var/log/syslog | cut -c 77-94 | sort | uniq > /tmp/syslog.macs.sort
comm -3 /tmp/dhcp.macs.sort /tmp/syslog.macs.sort
rm -f /tmp/syslog.macs.sort /tmp/dhcp.macs.sort

Dave