1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Display date/time when a client connects

Discussion in 'Tomato Firmware' started by bdf0506, Feb 23, 2014.

  1. bdf0506

    bdf0506 Serious Server Member

    I'm trying to figure out a way to show the exact date/time when a client connects to the router. I'd also like to figure out disconnect times too, but that's not as important.

    I can look in the arp tables or robocfg, which seem to show the mac address, but unless I have a script and monitor these constantly, it won't get the job done. Macs seem to stay cached in robocfg, so if the same mac connects a few days later, I wouldn't be able to know.

    Is there any other way to accomplish this with something built into the firmware that I don't know about?

    Any help is appreciated!
     
  2. koitsu

    koitsu Network Guru Member

    A script to monitor known/seen MAC addresses on a networking segment would be the only way you could accomplish this. This is just how Ethernet and TCP/IP in general works.

    I get the impression this is {another, as there are continual signs of these showing up on the forum recently} being prompted by a social problem. Please explain what it is you're ultimately trying to do/determine/accomplish.
     
  3. bdf0506

    bdf0506 Serious Server Member

    Thanks for the reply, kotisu.

    I'm looking to get this data in a log file of some sort, so I can see what dates/times a certain MAC address was connected to my network.

    I just didn't know if this was logged anywhere else in a location that I just wasn't looking in. It sounds like the best way to accomplish this is to have a script that monitors the output of `arp | awk '{print $1,$2,$4}'` unless there is a better place to grab this information, such as robocfg, or perhaps the dchp requests to /var/log/messages (everything on my network uses dhcp).

    I should be able to grab connect times when the entry first appears on the arp table, and I believe an entry drops off the arp table after being disconnected for 5 minutes.
     
  4. darkknight93

    darkknight93 Networkin' Nut Member

  5. jerrm

    jerrm Network Guru Member

    You can log dhcp requests, a client does not necessarily have to issue a dhcp request when it connects but in practice pretty much any dhcp client will. It will be difficult or impossible to tell the difference between a client that's been connected for hours and renewing vs a new connection. There is nothing done with dhcp when disconnecting though.

    ARP has other issues, a connected DHCP or static ip client could still fall off the ARP table if it is not actively passing traffic through the router. A static ip client causing all sorts of internal mayhem may never show up on the router's arp table at all.

    If wireless is your main concern, then "wl assoclist" will give a list of connected macs. For wireless, it is the most accurate, but maybe too much so, as any hibernating client will likely fall off the list immediately.

    None of the methods have any sort of "disconnect" log event, it would be necessary to compare against the last poll and recognize when a particular mac drops off the list.

    None of this should really be considered any sort of security function, mac spoofing and other exploits aren't difficult.
     
    Last edited: Feb 24, 2014

Share This Page