|
From: Nikolaos M. <nm...@ad...> - 2010-11-03 13:39:22
|
Many thanks for the detailed info. I wonder in what way I could capture arpnip output and store it (additionally) in a new table, as you indicate. Is there any ready-made script or I should prepare one from scratch? Nick On 29/10/2010 3:08 πμ, Brian De Wolf wrote: > > The results of a node search on the webpage are surprisingly > representative of the data present in the database, actually. The > tables only store a first and last time seen for a given ARP > relationship (MAC, IP), so when that relationship is seen again, the > last seen time is updated to the current time. > > So, unfortunately, if you try to use it for user tracking in an area > with lots of transitory machines (wireless with low lease times is a > good example), the data is almost entirely useless. The design itself > is understandable, though, as it keeps storage costs from shooting > through the roof. > > > Using the existing front-end might be difficult if you try to patch in > recording every data point. The existing tables are keyed on (mac, ip) > so you won't be able to insert rows for multiple times for a given pair. > I would expect the front-end to make assumptions about the existence of > only one entry for each (mac, ip) pair as well. Making arpnip record > to a new table, or to text files, would be easy enough, though. > Unfortunately, I'd expect performance on that table to slowly nose dive, > as it would experience constant growth on every arpnip run. > > > In our environment, we usually fall back to correlating IP usage with > our DHCP logs. Those are usually pretty clear about who had the lease > at any given time. I just pretend no one is spoofing IPs... > > |