[12642] in North American Network Operators' Group
Re: Netcom?
daemon@ATHENA.MIT.EDU (Erich Meier)
Mon Sep 29 14:39:55 1997
From: Erich Meier <Erich.Meier@informatik.uni-erlangen.de>
In-Reply-To: <Pine.SOL.3.93.970929095453.9156H-100000@zeppo> from Art Houle at "Sep 29, 97 10:04:59 am"
To: houle@zeppo.acns.fsu.edu
Date: Mon, 29 Sep 1997 16:33:00 +0200 (MET DST)
Cc: sreubelt@whistle.com, nanog@merit.edu
> Scott,
>
> One method to detect duplicate IPs is to use SNMP to query your routers
> every 4 hours for the ARP entries. (ARP times out every 4 hours in a cisco
> router) We use the CMU snmp package to do the queries. Then put the info
> into a database and query the database for duplicates. We have a system
> like this with a web interface and also some scripts that scan ths
> database daily for duplicates and e-mails notices to people in charge of
> the relevant subnet.
>
> The code is somewhat rough, so I do not want to offer it to the
> net-at-large. If you can not find a polished product, e-mail me and I'll
> share more aobut this solution.
>
> Art.
> On Mon, 29 Sep 1997, Scott wrote:
>
> > Alittle off subject but does anyone out there know of some SW that detects
> > duplicate IP addresses?
> >
> > Scott
> >
> >
I think you are searching for arpwatch. Source can be found at
ftp://ftp.ee.lbl.gov/arpwatch.tar.Z
It needs libpcap to run but that can be found also at this location.
Have fun,
Erich
--
Erich Meier Erich.Meier@informatik.uni-erlangen.de
http://www4.informatik.uni-erlangen.de/~meier
"The truth is not out there. The truth is not out there. The.." - Bart Simpson
