Track arp mac changes in network

arp-scan-monitor.js

const arpScanner = require('arpscan/promise')
const path = require('path')
const TCPJSONClientP = require(path.join(__dirname + "/..", "/services/abstract/TCPJSONClientP"))
const toRedis = new TCPJSONClientP()
const _ = require('lodash')

let results = []

if (process.argv[2]) {

  const sendMessage = (alert_level_id, message) => {
    console.log(message)
    toRedis.sendreceive({ to: "redisbrocker", message: { type: "alerts", action: "rpush", data: { alert_level_id: alert_level_id, data: message } } })
    .catch(e => console.error(e))
  }

  const onResult = (data) => {
    if (results.length === 0 && data.length === 0) {
      console.log('No hosts.')
    }
    else {
      let onlyIpMacChanges = process.argv[4] === 'only_ip_mac_changes'
      let newData = data.map(e => {
        let t = {}
        t.ip = e.ip
        t.mac = e.mac
        return t
      })
      if (newData.length > 0 && results.length === 0) {
        if (!onlyIpMacChanges) {
          let message = `Новые хосты: ${JSON.stringify(newData)}, ${new Date()}.`
          sendMessage(1, message)
        }
        results = newData
      }
      else if (newData.length === 0 && results.length > 0) {
        if (!onlyIpMacChanges) {
          let message = `Пропали хосты: ${JSON.stringify(newData)}, ${new Date()}.`
          sendMessage(1, message)
        }
        results = newData
      }
      else {
        let message = ""
        if (!onlyIpMacChanges) {
          // Найдем пропавшие хосты
          results.forEach(r => {
            if (!_.find(newData, r)) {
              message = message + `Пропал хост: ${JSON.stringify(r)}. `
            }
          })
          // Найдем новые хосты
          newData.forEach(n => {
            if (!_.find(results, n)) {
              message = message + `Новый хост: ${JSON.stringify(n)}. `
            }
          })
        }
        // Найдем если хосты изменил ип
        results.forEach(r => {
          let newHostData = _.find(newData, { mac: r.mac })
          if (newHostData) {
            if (newHostData.ip !== r.ip) {
              message = message + `Хост с mac: ${r.mac} изменил ip c ${r.ip} на ${newHostData.ip}.`
            }
          }
        })
        // Найдем если хосты изменили мак
        results.forEach(r => {
          let newHostData = _.find(newData, { ip: r.ip })
          if (newHostData) {
            if (newHostData.mac !== r.mac) {
              message = message + `Хост с ip: ${r.ip} изменил mac c ${r.mac} на ${newHostData.mac}.`
            }
          }
        })
        if (message.length > 0) {
          sendMessage(1, message + `${new Date()}.`)
        }
        results = newData
      }
    }
  }

  const onError = (err) => {
    throw err
  }

  const startArpScan = () => {
    console.log('Проверка...')
    arpScanner({ interface: process.argv[2] })
    .then(onResult)
    .catch(onError)
  }

  startArpScan()

  setInterval(() => {
    startArpScan()
  }, parseInt(process.argv[3]) * 1000 || 60000)
}
else {
  console.log('You need arp-scan (and npm arpscan) package installed. Use like this: sudo node arp-scan-monitor.js interfacename intervalinseconds [only_ip_mac_changes]  \n Необходим пакет arp-scan (а так же npm-пакет arpscan). Использовать так: sudo node arp-scan-monitor.js наименованиеинтерфейса интервалвсекундах [only_ip_mac_changes]')
}