I am trying to develop an app that will continually monitor my network and alert me when a new, never seen before device is plugged in to the LAN.
My thought is to use Splunk Stream and monitor ARP messages coming across the wire. I would then keep a lookup table updated with all the MAC addresses that have been seen so far and alert when I see a new one.
Any thoughts on this approach?
Any major hurdles I may not have thought of?
Any alternative methods that anyone can think of?
Make a kvstore backed lookup. Where the key is the mac address and has a column for lastSeen. Have a search that updates the lookup.
Use the lookup like this
index=myindex sourcetype=myarp data | lookup macTracker macaddress OUTPUTNEW lastSeen isFound | where isnull(isFound)
That would give you events where the mac has never been seen before.