On Mon, 5 Feb 2007, Dan Oetting wrote:
> On Jan 19, 2007, at 5:02 AM, Peder Magne Sefland wrote:
> >We use DHCP and I would like to get an sms-message when this
> >mac-address enter the network. Can this be done today?
> On a small scale such as having only 1 MAC address that you need to catch, you
> could configure your DHCP servers to assign this MAC a specific IP.
> With the suspect confined to a known set of IP addresses you could also setup
> a sniffer on the external routes to capture all traffic from those IPs to see
> for yourself if there is abuse.
> I am surprised that switches can't generate an SNMP trap whenever a new MAC
> address is added to it's routing tables.
You probably mean bridge table, anyway, are you sure? For Cisco I've read
that you can do this:
"You can generate SNMP traps whenever a MAC address change occurs by
enabling the set snmp trap enable macnotification command in conjunction
with enabling the set cam notification and set cam notification
I haven't tested it yet, maybe someone out there has?
We have SNMP trap on TODO for NAV 3.3, we are thinking of an
implementation that can trigger certain scripts on a given snmp trap oid.
We see to very interesting use cases:
* when linkdown/up trap is detected update the cooresponding link value
in the swport/gwport database table.
* when a new mac address is seen/gone trigger a script that
opens/closes corresponding machine tracker records (cam table).
This script could also post alarms regarding wanted mac addresses.