# MAC address.



## xolod-ru (Aug 16, 2009)

Hey all! 

Young people help please ... There is a router with two network interface card (rl0 - Online and rl1 - LAN), LAN from ~ 200 PC 
There is a need to track MAC addresses of connected devices to rl1 (LAN), in the following format: MAC and the time of 
Advise please Program / sniffer ... 

P.S. freebsd 6.4


----------



## mk (Aug 16, 2009)

net-mgmt/arpwatch


----------



## xolod-ru (Aug 16, 2009)

REPORT MESSAGES
Here's a quick list of the report messages generated by arpwatch(8) (and arpsnmp(8)): 
new activity 
This ethernet/ip address pair has been used for the first time six months or more. 
new station 
The ethernet address has not been seen before. 
flip flop 
The ethernet address has changed from the most recently seen address to the second most recently seen address. (If either the old or new ethernet address is a DECnet address and it is less than 24 hours, the email version of the report is suppressed.) 
changed ethernet address 
The host switched to a new ethernet address.

If you disconnect, and after 5 minutes re-connect, and if he / she is given the same IP which he received 5 minutes ago, arpwatch ignore such a connection! 
arpwatch - This is simply a monitoring system, the new devices in the LAN. 

Unfortunately, this option nepodhodit. 
What else will offer?


----------



## DutchDaemon (Aug 16, 2009)

Arpwatch should work fine. 

Put this in /etc/rc.conf:

```
arpwatch_enable="YES"
arpwatch_interfaces="rl1"
```

Run [cmd=]/usr/local/etc/rc.d/arpwatch start[/cmd].

See /usr/local/arpwatch/arp.rl1.dat. The third field is the time (convert with [cmd=]date -r[/cmd]).

Or run [cmd=]arpwatch -d -i rl1[/cmd] for a few minutes and watch the output.


----------



## Alt (Aug 16, 2009)

xolod-ru said:
			
		

> Unfortunately, this option nepodhodit.


Zachot))

You can try to install dhcpd, and track logs for new requests.. This is podhodit? =)


----------

