2

So, I have been tasked with researching and deploying some kind of network auditing software. All this really needs to do is be able to ping/TCP-connect-scan a handful of internal /24 networks at regular intervals (every 24h or whatever) and send out an email if a new host is discovered or if a previously-existing host has gone away. Silly-simple to implement via Perl hackery, but Bossman wants a Shiny Web Interface(tm) and doesn't really want to pay for it. I've played around a bit with Zenoss, but that seems like using a sledgehammer to swat a housefly. Do you folks know of any software that can do that? Preferably this would run on a linux box, but I'm not going to be overly-picky at this point...

Many thanks!

Improve this question

4 Answers 4

Reset to default
2

The easiest way to do this is using something similar to Arpwatch

Improve this answer
2
  • +1 for suggesting a scalable and intelligent approach to the problem.
    – Helvick
    Nov 7, 2009 at 1:11
  • Yes, but will it work in a switched environment? Or will I have to multi-home my scanning box so it can see arps on the many (4 and counting) /24 networks it'll have to monitor?
    – law
    Nov 7, 2009 at 1:43
0

Most network reporting software can do this kind of autodetection, so it's really a matter of finding something that fits your requirements. You mentioned ZenOSS being too heavy, and that's fair, but for this kind of thing you'll generally be looking at some sort of network monitoring framework.

I know that Zabbix can also do this kind of probing and detection, and it's reasonably lightweight if you don't configure all the extra bits. It may not be ideal, but it'll certainly work.

Improve this answer
0

It sounds like nmap-diff does most of what you need. You'd have to convert its output to HTML but that's trivial if you're comfortable with Perl. :)

Improve this answer
0

You can also try The Dude

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .