Checks for ARP anomalies from the host's viewpoint

[mjomha]

Description: Looks for ARP anomalies from the host's side.

What The Data Shows: Shows all ARP entries as well as the total entries on a host.

SQL: 

SELECT address, mac, COUNT(mac) AS mac_count 
FROM arp_cache 
WHERE mac NOT LIKE '01:00:5E%' 
AND mac NOT LIKE 'ff:ff:ff%'
GROUP BY mac HAVING count(mac) > 1;

[jnelson]

@mjomha what about filtering our multicast IPs and/or broadcast MACs?

[mjomha]

Good idea. Let me give that a go and update the query. I was filtering within the Live Ops Gui, let me try adding that to the query.

[mjomha]

Updated the query now it filters out broadcast and multicast addresses.

[jnelson]

@mjomha you left off the HAVING count(mac) > 1 from your original query. Was this on purpose?

[jnelson]

@mjomha you left off the HAVING count(mac) > 1 from your original query. Was this on purpose?

[mjomha]

Thanks Jneslon for noticing. Accidentally deleted the last line.

Re-added it.

Thanks!