Hi,
The existing ARP discovery module just looks at the local machine's ARP
cache.
We really need one that listens to ARP packets and builds a complete map
of IP/MAC addresses for the subnet.
The goal is to listen to ARP packets and cache all the IP/MAC pairs you
hear. Periodically send updates upstream to the CMA (in JSON) when
something new is discovered. Probably no more often than every 30
seconds or so.
Write code that links to libpcap (like the switch discovery code does)
but listens for ARP request packets instead. When you receive an ARP
request, examine the packet, compare it to the module's local cache, and
if it's a new or changed combination, then update the cache and mark the
cache "dirty". Every 30 seconds or so, look and see if the cache is
dirty, and if so, create a JSON packet describing the entire cache and
send it upstream. Alternatively, just send the updated entries. Not
sure which way is best...
May also want to do something examining the local system's ARP cache and
merging it in before sending things upstream... That would make some
aliases appear in the cache which might otherwise be missed -- or maybe
we don't care...
This is somewhat similar (but probably simpler) to code that already
exists for reading LLDP or CDP packets.
Since this is nanoprobe code, and it needs to link to libpcap, that
means this is in 'C'.
Volunteers?
--
Alan Robertson <[email protected]> - @OSSAlanR
"Openness is the foundation and preservative of friendship... Let me claim
from you at all times your undisguised opinions." - William Wilberforce
_______________________________________________
Assimilation mailing list - Discovery-Driven Monitoring
[email protected]
http://lists.community.tummy.com/cgi-bin/mailman/listinfo/assimilation
http://assimmon.org/
