How do we get Trap/Alarm for a Wirless Client Appearing on Network?

len.holloway · ‎02-11-2010

I have asked the question several times on T.A.C just seeing if there is any other way of doing this?

We had a wireless laptop stolen and in case it appeared back on the network we wanted a way of getting an alarm/event automaticaly without doing manual reports!

We have Cisco works LMS and the WCS but both are unable to do this, I still have a case logged with our maintenance provider.

There doesn't seem to be a syslog or snmp trap that could be sent to an NMS statiion available , the WCS can do a manual client session report, looked into using location appliance but didn't get anywhere, also rougue client mac's! Awaited latest upgraded versions of LMS and WCS but nothing new in there?

Any ideas, this would be useful in other areas if we want an alarm say for a wired device as well!

Thanks Len

ericgarnel · ‎02-22-2010

If you are running isc-dhcp on a *nix or *bsd server, you can write a simple script that parses the dhcp.leases file for the offending mac and then pipe it to mail

cat dhcpd.leases |grep '00:23:6c:dd:46:6d' | mail -s "laptop alert" eric@my.email.com

and then run it as a cron job; scheduled as needed.

or a little more complex to parse out duplicates

(change to your dhcpd.leases location)

cat /var/db/dhcpd/dhcpd.leases | grep iPhone | awk '!($0 in a) {a[$0];print}'

len.holloway · ‎03-04-2010

Thanks for your reply!

The dhcp servers are runing on windows operating systems and dont belong to our team, so wont be able to write any scripts to do this, I was hoping for the Cisco NMS to do this but I will wait and see if any enhancements get added!

len