Monitoring the number of active hosts on the network

Recently, I faced the task of determining the number of enabled computers on several subnets of our organization. The network is terribly running: there is no domain or remote installation tools, so it was not possible to install the monitoring agent on all computers. On the other hand, on many computers a firewall was turned on, which is why computers did not respond to a ping request.

To solve this problem, I used a wonderful utility arping .


')


Arping works at the second level of the OSI model and is not blocked by a firewall, since the computer must respond to ARP requests so that it can receive IP packets. The downside to arping compared to ping is that arping works within the same local network and is not routed. However, this restriction can be circumvented by using ARP proxying .

To start, I wrote a simple PHP script (this is the only language I know ☺) using arping. Networks and masks are set, and the script in a cycle pings each IP address in them:

<? php
// set the network and masks
$ subnets = array ( "192.168.0.0/255.255.255.0" , "10.10.8.0/255.255.252.0" ) ;

$ up = 0 ; // number of live hosts
foreach ( $ subnets as $ subnet )
{
list ( $ addr , $ mask ) = explode ( '/' , $ subnet ) ;
// calculate the starting and ending address
$ start = ( ip2long ( $ addr ) & ip2long ( $ mask ) ) + 1 ;
$ end = $ start + ( ~ ip2long ( $ mask ) ) - 1 ;
// run through all the addresses and arping them
for ( $ ip = $ start ; $ ip <= $ end ; $ ip ++ )
{
$ response = shell_exec ( "arping -c 2" . long2ip ( $ ip ) ) ;
if ( ! strstr ( $ response , '0 packets received' ) ) $ up ++;
}
}
echo $ up . " \ r \ n " ;
?>

But of course, such a script is not suitable for continuous monitoring. First, I would like it to work constantly in the background. Secondly, the verification should be carried out in several streams - so faster.

As a result, I rewrote the script like this:

• Settings and network addresses are read from the ini-file.
• The "Papa" script runs an instance of the child script for each network and controls its operation.
• The child script checks all its network addresses in a circle and updates the information in Memcached. In addition to the number of active nodes, their mac, dns and netbios name is stored.
• From memcached this data can be viewed on a web page or in zabbix.

You can see the list of computers in the ascetic web interface:


I also added a chart in Zabbix (see the beginning of the post).
To do this, you need to add a line for each network in the zabbix_agentd.conf file:
UserParameter=network_count. net_name ,/usr/local/bin/php / /get_network_stats.php net_name
On the server add the appropriate item.

And set up a schedule.
The get_network_stats.php <network_name> script gives the number of active hosts by the network name. I think that users of other monitoring systems will be able to easily attach this script to them.

I will not give the source, because he is big. Download it - readme attached.
I think, who needs such a thing, can rewrite it to fit your needs: for example, you can use a regular file instead of memcached.