search

leiweibau / Pi.Alert

Scan the devices connected to your WIFI / LAN and alert you the connection of unknown devices. It also warns if a "always connected" device disconnects. In addition, it is possible to check web services for availability. For this purpose HTTP status codes and the response time of the service are evaluated.
https://leiweibau.net
GNU General Public License v3.0
342 stars 25 forks source link

Automated NMAP #272

Closed RumpleNJ closed 2 months ago

RumpleNJ commented 4 months ago

I have a small network with 3 subnets. I very much do not want a single machine on all three of them, and not all of them have a Linux box on them. I did see the previous issue #271 where you discussed the possible use of NMAP.

I am hoping to persuade you to give us this option. Even if it has to come with a giant warning, or maybe give it to us as something we can run manually once a day by clicking a button? I very much appreciate all the work you put into this, and if I had a tenth of your skills, I might try myself, but if I did, I wouldn't be here.

I think the manual method, where we enter a subnet, select a simple or normal, or deep scan, click a button, and wait for it to say it has finished would result in the least amount of trouble on your end. And this would allow those of us with split networks to still use your tool.

Again, thank you for everything so far.

R

leiweibau commented 4 months ago

I very much do not want a single machine on all three of them ... think the manual method, where we enter a subnet ...

While I was working on the manual Nmap scan and things that follow it, I thought about your request for an Nmap scan on subnets. When Nmap does a scan of a subnet where the executing host is not itself located, there is no way to determine the MAC address. Where should the results be stored? The "main" devicelist uses the MAC address as a unique identifier within the database. I cannot use this for the hosts detected by Nmap because I do not know it. I didn't actually intend to generate a MAC address myself, because then I would certainly be asked why these MAC addresses are possibly recognized as "random MAC". I don't really want to create another list either. The alternative would be to grant the host on which you have installed Pi.Alert access to all subnets.

RumpleNJ commented 4 months ago

I don't know why, but I assumed you were using IP to sort. Thinking about it, I can see how a network with DHCP would be chaotic that way. I don't have any answer, sorry.

leiweibau commented 4 months ago

No problem. After all, I'm here to answer such questions and explain certain functions. Such an Nmap scan could only serve as a supplement.

Another option would be to tranfert the results into the "ICMP monitoring". Here the IP serves as a reference. Hosts in the subnet of the Pi.Alert would then have to be filtered out. I still don't have a real idea for an implementation.

RumpleNJ commented 4 months ago

Anything that doesn't involve me connecting multiple subnets via one PC would be great. Even if it's a little clunky to setup, you only set it up once. After that, anything new that shows up is what you're looking for.