search

mimugmail / opn-repo

OPNsense repo by mimugmail
Other
325 stars 24 forks source link

Feature request: opn-arp sends an email about IP-conflicts. #204

Open hboetes opened 4 months ago

hboetes commented 4 months ago

Recently, a guest joined our guest WLAN, and he reported an IP conflict from his Windows desktop of the firewall IP.

I couldn't find that IP conflict on the host, but it got me thinking. A bit of googling later, and I installed the opn-arp plugin, which is nice, but doesn't do very much without a bit more hacking from the user.

I don't care about new ARP entries, it's a guest network after all, but if there is an IP conflict I'd like to know about it, and receive an email, especially if someone is indeed spoofing the firewall IP.

Ideally this would be possible with the extension itself, but a how-to would also be an idea.

hboetes commented 4 months ago

Ah, I just tested it: this is already detected in the dmesg:

arp: 9e:23:1c:2f:fa:68 is using my IP address 10.10.30.1 on vtnet0!
arp: 9e:23:1c:2f:fa:68 is using my IP address 10.10.30.1 on vtnet0!
arp: 9e:23:1c:2f:fa:68 is using my IP address 10.10.30.1 on vtnet0!
arp: 9e:23:1c:2f:fa:68 is using my IP address 10.10.30.1 on vtnet0!

Now all I need to do is write a log watcher that can send emails.