Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Another day, another question !

I am trying to write a script that would monitor my LAN for any new new devices connected to it and if it finds a new device, send me an email.

My test network is a very simple one consisting of just 1 cisco 2900XL switch. So far the script can runs every 2 minutes (cronjob) and finds the new mac address.

How can I get the IP information corresponding to the mac found? This is what I have so far :

  1. Scan scan through the DHCP leases file of the dhcp server to see what IP was assigned to the device (if the device is set to DHCP though)

  2. If my network had a router look through its routing tables for the mac entry, but my setup is a simple one and does not need one.

Also method#1 would fail if the device had a static ip on it.

Any ideas for this ?


share|improve this question
up vote 3 down vote accepted

Arpwatch is available and already does what you want. Depending on your distribution, it's easy to install.

share|improve this answer
Its a great tool with a long memory. You can check its database to see when a device was last seen. I usually configure it to email me whenever it sees a new device. – BillThor Feb 6 '11 at 17:16
@svenW I configured arpwatch with the parameter eth1 -f /var/lib/arpwatch/arp.dat -n but for some reason its still listening on eth0 output from message log Feb 6 13:17:41 LINUX-GATEWAY arpwatch: listening on eth0 – ankit Feb 6 '11 at 18:20
Did you specify -i eth1? Because -i is the parameter used to specify the interface. – Sven Feb 6 '11 at 18:25
followed the guide here. Even when i add the flag -i (the config file now has the line -i eth1 -f /var/lib/arpwatch/arp.dat -n it still listens on eth0 – ankit Feb 6 '11 at 18:28
this is weird .. when i launch the command arpwatch -i eth1 -f /var/lib/arpwatch/arp.dat -n from the shell, arpwatch does listen on eth1 but does not log any output to the file specified. do see stations being discovered from the log output Feb 6 13:38:42 LINUX-GATEWAY arpwatch: new station 0:1e:ec:c4:8f:82 – ankit Feb 6 '11 at 18:40

Show arp tables:

Linux: $ arp -an
Cisco: >show arp

better use of ICMP and SNMP for device discovery.

share|improve this answer
ARP did come to mind but isn't it only on demand. What i mean is that when a new device plugs into the cisco switch, then sends a resuest for a DHCP server and get the IP information from it. Till this point since this device has not tried to communicate with my controlling device, there would be no entry in the ARP table in my controlling device. Am i right ? – ankit Feb 6 '11 at 17:09
@ankit ARP is done when a device comes online to ensure its address is available. This is how arpwatch works. Without ARP a device can only work in passive mode as no other devices will know where to send it packets. Switches tend not to send any traffic to a port until there is a device does an ARP. – BillThor Feb 6 '11 at 17:22
@antil arp table have timeout. after timeout arp entry clean. Better use arpwatch. – alvosu Feb 6 '11 at 18:07

Another way which may be useful is to use nmap and scan your entire network. This way you can get all of the devices connected on your network. Just create a script that runs it as a cron job.

share|improve this answer
that would work but would not be feasible for a large network .. scanning the whole thing every 2 minutes. – ankit Feb 6 '11 at 17:21
@ankit: Every two minutes is overkill anyway. – Sven Feb 6 '11 at 17:28
nmap is capable of scanning very large networks. It's just a matter of timing & scanning options. – petrus Feb 15 '11 at 23:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.