Closed Wyko closed 7 years ago
Solution:
Use ARP instead of MAC Address Table Pros: -ARP is actually designed for this use case, since it ties IP's to MAC's Cons: -Layer 2 devices will not have a related entry -Will have to establish scanning for ARP entries
Tie MAC entries to a device's IP's For each unique subnet from the CSV, collect a list of the MAC addresses which have that subnet as at least one network on it's associated device. Cons: -Less accurate
Implemented in the tools.mac_audit
module
The MAC Audit module will take a csv (or any other input, as added in the future) and to compare it with the database of polled mac addresses. The purpose is for things like Rogue AP audits, where a rogue device may be detected, its MAC polled, and then compared against macs connected to switchports for a similar OUI.
For each csv mac address:
The csv needs at minimum the
mac
column as well as either anetwork_ip
column or anip
andsubnet
column.Challenges: