Wubot::Plugin::Arp - monitor the arp table for new entries


version 0.2.004



  delay: 60


Monitor the arp table by parsing the output of 'arp -a'. Any time a previously unseen entry shows up in the arp table (using a combination of the name, ip, and mac address), a message will be sent containing:

  name: the hostname
  ip: the host ip address
  mac: the mac address
  subject: New arp table entry: $ip {$name) = $mac

This can be a great tool for alerting you to new machines showing up on your private network.


The Arp monitor uses the global cache mechanism, so each time the check runs, it will update a file such as:


The monitor caches all combinations of name+ip+mac. When a new (previously unseen) subject shows up on the feed, the message will be sent, and the cache will be updated. Removing the cache file will cause all arp entries to be sent again.


If you wanted to store all ARP addresses in a sqlite database, you could use a rule such as this in the reactor:

  - name: Arp
    condition: key matches ^Arp
    plugin: SQLite
      file: /usr/home/wu/wubot/sqlite/mac_address.sql
      tablename: mac_address

The 'mac_address' schema is distributed in the config/schemas/ directory in the wubot distribution.


check( $inputs )

The standard monitor check() method.