This script provides infrastructure for logging devices for which Bro has been able to determine the MAC address, and it logs them once per day (by default). The log that is output provides an easy way to determine a count of the devices in use on a network per day.
Note
This script will not generate any logs on its own, it needs to be supplied with information from elsewhere, such as policy/protocols/dhcp/known-devices-and-hostnames.bro.
Namespace: | Known |
---|---|
Source File: | /scripts/policy/misc/known-devices.bro |
Known::known_devices: set &create_expire = 1.0 day &synchronized &redef | The set of all known MAC addresses. |
Known::DevicesInfo: record | The record type which contains the column fields of the known-devices log. |
Known::log_known_devices: event | An event that can be handled to access the Known::DevicesInfo record as it is sent on to the logging framework. |
Type: | set [string] |
---|---|
Attributes: | &create_expire = 1.0 day &synchronized &redef |
Default: | {} |
The set of all known MAC addresses. It can accessed from other scripts to add, and check for, addresses seen in use.
We maintain each entry for 24 hours by default so that the existence of individual addresses is logged each day.
Type: |
---|
The record type which contains the column fields of the known-devices log.
Type: | event (rec: Known::DevicesInfo) |
---|
An event that can be handled to access the Known::DevicesInfo record as it is sent on to the logging framework.