How to Detect Disconnected Client from Our Network

Overview

If you have a Linux box which act as gateway or Captive Portal, you might want to do something fancy when client get connected or disconnected from your box. As an example, you want to modify some iptables rules as soon as client leave your network.

Problem

You want to detect status of a machine as soon as it disconnected form your network. The arp command utility still displaying client which already gone from our network. The default cache time inside Linux kernel might be set for longer period of time.

Solution

Instead of using arp utility, we can use ip command utility as tool for displaying statistics of our "neighbors". Below is an example of showing status of our neighbors.

$ sudo ip -s neigh show wlan0
192.168.1.106  used 216999/216995/216963 probes 1 FAILED
192.168.1.108 lladdr xx:04:eb:0a:e8:xx used 177/175/144 probes 6 REACHABLE
192.168.1.113  used 116162/116270/116159 probes 6 FAILED
192.168.1.111  used 167101/167966/167009 probes 1 FAILED
192.168.1.112  used 169884/170066/169881 probes 6 FAILED
192.168.1.110  used 254640/254634/254596 probes 1 FAILED
192.168.1.115  used 299618/299664/299610 probes 3 FAILED
192.168.1.114  used 759881/759876/759848 probes 1 FAILED
192.168.1.116  used 296712/296659/296638 probes 1 FAILED
192.168.1.101  used 1132275/1132259/1132230 probes 1 FAILED
192.168.1.105 lladdr yy:fa:00:b4:7e:yy used 35/35/0 probes 1 STALE
192.168.1.103  used 190430/190457/190426 probes 5 FAILED
192.168.1.104  used 250922/254626/250921 probes 6 FAILED
192.168.1.107 lladdr zz:3a:61:e4:7b:zz used 35/35/1 probes 1 STALE

Let say we want to know the status of machine which has address xx:04:eb:0a:e8:xx, we could simply do something like this.

$ sudo ip -s neigh show dev wlan0 | grep xx:04:eb:0a:e8:xx │ awk '{print $NF}'
REACHABLE

This one-liner below useful for keeping the statistics refreshed every 1 seconds, in the combination with terminal multiplexer like tmux you can split your window and monitor your network easily.

$ while :; do clear; ip -s neigh show dev wlan0; sleep 1; done

It's a note not a blog