How can I configure the software to only keep the last entry for an IP? I have been working with the updatenetdb.pl setting for opthours * 24. I tried setting it down to .0018 to only keep very recent entries. When I pass -dm -d 1 to the script it still deletes everything. I would like to just have one try in the db.
Thanks!
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Let me make sure I understand what you need. You only want to keep the latest ARP entry for an IP in the database, and if a new device comes online and uses that IP, you want the old entry to go away? What if the IP has not been used in 3 days, do you still want it to show up?
From the command line, you can search by the hour instead of by the day, but that may not be good enough:
netdb -vl 1 -h 1 (everything on vlan 1 in the past hour)
The program was designed to keep all records on the network and then only show you the entries for the past day or few hours. It was never made to give only real-time data. Still, I could give you a copy of NetDB.pm that deleted old ARP entries when a new device started using the same IP. That way there would be only one ARP entry per IP. Would that be what you are looking for?
Jonathan
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Yes, I only care to be able to find the last location where the IP appeared on the network. I have integrated my IP Siwth your product to track down the location of an offending IP. After obtaining results from netdb, it then connects to the specified switch and switchport and turns off the port. A bit harsh, but my IPS rules are solid. I understand it's not real time, but it is good enough for our purposes…thanks again!
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
How can I configure the software to only keep the last entry for an IP? I have been working with the updatenetdb.pl setting for opthours * 24. I tried setting it down to .0018 to only keep very recent entries. When I pass -dm -d 1 to the script it still deletes everything. I would like to just have one try in the db.
Thanks!
I meant I set it to .06 in an attempt to delete anything older than 3:45…
tdub,
Let me make sure I understand what you need. You only want to keep the latest ARP entry for an IP in the database, and if a new device comes online and uses that IP, you want the old entry to go away? What if the IP has not been used in 3 days, do you still want it to show up?
From the command line, you can search by the hour instead of by the day, but that may not be good enough:
netdb -vl 1 -h 1 (everything on vlan 1 in the past hour)
The program was designed to keep all records on the network and then only show you the entries for the past day or few hours. It was never made to give only real-time data. Still, I could give you a copy of NetDB.pm that deleted old ARP entries when a new device started using the same IP. That way there would be only one ARP entry per IP. Would that be what you are looking for?
Jonathan
Yes, I only care to be able to find the last location where the IP appeared on the network. I have integrated my IP Siwth your product to track down the location of an offending IP. After obtaining results from netdb, it then connects to the specified switch and switchport and turns off the port. A bit harsh, but my IPS rules are solid. I understand it's not real time, but it is good enough for our purposes…thanks again!