#!/usr/bin/perl -w
                                                                      
+                                                                     
+                                                         
# Garret D. Kelly, Oct 13th, 2004
# garret.kelly@gmail.com
# Do what you will.
                                                                      
+                                                                     
+                                                         
use strict;
use IPC::Shareable;
use POSIX qw(ceil);
use Term::ANSIColor qw(:constants);
                                                                      
+                                                                     
+                                                         
my %options = (destroy => 'yes', create => 'yes');
                                                                      
+                                                                     
+                                                         
my $purgedelay = 3600;
my $dispdelay = 5;
                                                                      
+                                                                     
+                                                         
# The shareable segment remains dirty because this program never
# exits clean. Teehee. We _must_ clean the shm here or we'll get
# last run's counts.
IPC::Shareable->clean_up;
                                                                      
+                                                                     
+                                                         
# Process command-line arguments here.
                                                                      
+                                                                     
+                                                         
sub watch_traffic {
        my %arpcounts;
        tie %arpcounts, 'IPC::Shareable', 'narp', {%options};
        %arpcounts = ();
        # For some reason this doesn't perform like you think
        # it would. I think it might be something to do with
        # the way tcpdump pukes its output to us.
        while(1) {
                open TD, "-|", "tcpdump -ni eth0";
                while(<TD>) {
                        if(/arp/) {
                                chomp;
                                my @dumpparts = split / /, $_;
                                my $addr = $dumpparts[$#dumpparts];
                                if(!$arpcounts{$addr}) {
                                        $arpcounts{$addr} = 1;
                                } else {
                                        $arpcounts{$addr} = $arpcounts
+{$addr} + 1;
                                }
                        }
                }
                close TD;
                print BOLD, RED, "Warning: ", RESET, "Pipe to tcpdump 
+broken\n";
        }
}
                                                                      
+                                                                     
+                                                         
                                                                      
+                                                                     
+                                                         
$|++;
                                                                      
+                                                                     
+                                                         
# Fork off a thread for watching for traffic.
if(fork() == 0) {
        watch_traffic();
}
                                                                      
+                                                                     
+                                                         
# We'll clear the arp counts every hour to make sure we
# don't get a huge backlog or anything like that.
if(fork() == 0) {
        my %ac;
        tie %ac, 'IPC::Shareable', 'narp', {%options};
        while(1) {
                sleep $purgedelay;
                %ac = ();
        }
}

# Compute stats and display abusers every so often;
while(1) {
        system('clear');
        my %arpcounts;
        tie %arpcounts, 'IPC::Shareable', 'narp';
        print BOLD, "arpsnitch", RESET, " v0.1a -- Garret D. Kelly -- 
+", BOLD, "Current Average: ", RESET;
        my ($avg, $avgdeviance, %deviants);
        for(keys %arpcounts) {
                $avg += $arpcounts{$_};
        }
        if((scalar keys %arpcounts) == 0) {
                print "N/A\n\nNo statistics have been accumulated so f
+ar.";
                sleep $dispdelay;
                next;
        }
        $avg /= scalar keys %arpcounts;
        print ceil($avg) . "\n";
        print BOLD, BLACK, "IP\t\t\tCOUNT\t\tDEVIANCE\n", RESET;
        for(keys %arpcounts) {
                $avgdeviance += $arpcounts{$_} - $avg;
        }
        $avgdeviance /= scalar keys %arpcounts;
        for(keys %arpcounts) {
                if($arpcounts{$_} - $avg > $avgdeviance) {
                        print BOLD, RED, "$_\t\t", RESET, "$arpcounts{
+$_}\t\t" . ceil($arpcounts{$_} - $avg) . "\n";
                }
        }
        sleep $dispdelay;
}

[download]

In reply to ARP Storm watcher by gkelly

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.