User Tools

Site Tools


pom-ng:analyzer:arp

Analyzer arp

This analyzer listens to ARP packets and generates events out of them. Its main goal is to monitor ARP activity and provide useful information if the pair IP/MAC changes.

Events

Name Payload associated Description
arp_new_stanoNew station found.
arp_sta_changednoStation MAC address changed.

arp_new_sta

This event is generated when a new station is found.

Field Type Description
mac_addrmacMAC address of the station.
ip_addripv4IPv4 address of the station.
vlanuint16VLAN id where the station was observed. 0 means the native VLAN.
inputstringInput name from which the event was observed.

arp_sta_changed

This event is generated the MAC address of a station changed.

Field Type Description
old_mac_addrmacOld known MAC address of this station.
new_mac_addrmacNew MAC address observed for this station.
ip_addripv4IPv4 address of the station.
vlanuint16VLAN id where the station resides. 0 means the native VLAN.
inputstringInput name from which the event was observed.
pom-ng/analyzer/arp.txt · Last modified: 2020/05/26 21:59 by 127.0.0.1