/ 
wubot-0.1_9
/ Wubot::Plugin::Arp

NAME

Wubot::Plugin::Arp - monitor the arp table for new entries

VERSION

version 0.1_9

SYNOPSIS

~/wubot/config/plugins/Arp/myhostname.yaml

---
delay: 60

DESCRIPTION

Monitor the arp table by parsing the output of 'arp -a'. Any time a previously unseen entry shows up in the arp table (using a combination of the name, ip, and mac address), a message will be sent containing:

name: the hostname
ip: the host ip address
mac: the mac address
subject: New arp table entry: $ip {$name) = $mac

This can be a great tool for alerting you to new machines showing up on your private network.

CACHE

THe Arp monitor uses the global cache mechanism, so each time the check runs, it will update a file such as:

~/wubot/cache/Arp-myhostname.yaml

The monitor caches all combinations of name+ip+mac. When a new (previously unseen) subject shows up on the feed, the message will be sent, and the cache will be updated. Removing the cache file will cause all arp entries to be sent again.

SQLite

If you wanted to store all ARP addresses in a sqlite datbase, you could use a rule such as this in the reactor:

- name: Arp
  condition: key matches ^Arp
  plugin: SQLite
  config:
    file: /usr/home/wu/wubot/sqlite/mac_address.sql
    tablename: mac_address

The 'mac_address' schema is distributed in the config/schemas/ directory in the wubot distribution.