How to Detect Disconnected Client from Our Network

Tags: February 19, 2015 9:01 PM


If you have a Linux box which act as gateway or Captive Portal, you might want to do something fancy when client get connected or disconnected from your box. As an example, you want to modify some iptables rules as soon as client leave your network.


You want to detect status of a machine as soon as it disconnected form your network. The arp command utility still displaying client which already gone from our network. The default cache time inside Linux kernel might be set for longer period of time.


Instead of using arp utility, we can use ip command utility as tool for displaying statistics of our "neighbors". Below is an example of showing status of our neighbors.

$ sudo ip -s neigh show wlan0  used 216999/216995/216963 probes 1 FAILED lladdr xx:04:eb:0a:e8:xx used 177/175/144 probes 6 REACHABLE  used 116162/116270/116159 probes 6 FAILED  used 167101/167966/167009 probes 1 FAILED  used 169884/170066/169881 probes 6 FAILED  used 254640/254634/254596 probes 1 FAILED  used 299618/299664/299610 probes 3 FAILED  used 759881/759876/759848 probes 1 FAILED  used 296712/296659/296638 probes 1 FAILED  used 1132275/1132259/1132230 probes 1 FAILED lladdr yy:fa:00:b4:7e:yy used 35/35/0 probes 1 STALE  used 190430/190457/190426 probes 5 FAILED  used 250922/254626/250921 probes 6 FAILED lladdr zz:3a:61:e4:7b:zz used 35/35/1 probes 1 STALE

Let say we want to know the status of machine which has address xx:04:eb:0a:e8:xx, we could simply do something like this.

$ sudo ip -s neigh show dev wlan0 | grep xx:04:eb:0a:e8:xx │ awk '{print $NF}'

This one-liner below useful for keeping the statistics refreshed every 1 seconds, in the combination with terminal multiplexer like tmux you can split your window and monitor your network easily.

$ while :; do clear; ip -s neigh show dev wlan0; sleep 1; done


Share on Facebook Twitter


Post a Comment