Question about adding some basic arpwatch functionality to librenms

Feature Requests
1

I was curious if it were possible to recreate some basic features of arpwatch into librenms.
The two features would be, alerts for new device (MAC) detected, and FLIP/FLOP for IP conflict detection.
I think it would require the arp history to be configurable,
I see where I can extend the FDB purge in config.php, but I don’t see one for ARP purge.

then maybe an alert macro for New_Mac and Mac_Flip_flop?

I’d love it if I could get the alert template to include the MAC, IP, switch IP and IfName.
Sorry if this can already be done with alerts, I couldn’t find it.

If I just had these I could shut down my arpwatch server.
Thanks for your consideration!

2

Hello.
I created something like this some time ago. Here’s my notes.
What it was supposed to do:

First of all you need to enable polling of fdb_tables. Then you use sql alerting to detect new mac in vlan 3333 (as an example) which showed within last 15 minutes. If I remember - it worked well.

SQL QUERY:

select UNIX_TIMESTAMP(ports_fdb.updated_at), ports_fdb.mac_address from ports_fdb join vlans on ports_fdb.vlan_id = vlans.vlan_id where vlans.vlan_vlan = 3333 AND UNIX_TIMESTAMP(ports_fdb.updated_at) >= UNIX_TIMESTAMP(NOW() - INTERVAL 15 MINUTE);

OVERRIDE SQL ALERT:

select UNIX_TIMESTAMP(ports_fdb.updated_at), ports_fdb.mac_address from ports_fdb join vlans on ports_fdb.vlan_id = vlans.vlan_id where vlans.vlan_vlan = 3333 AND UNIX_TIMESTAMP(ports_fdb.updated_at) >= UNIX_TIMESTAMP(NOW() - INTERVAL 15 MINUTE) HAVING count(ports_fdb.mac_address) > 10;

Polling:

./discovery.php -h all -m fdb-table

Here’s a bonus. It supposed to detect over 10 macs in specified vlan within last 15 minutes.
Can’t remember if it worked, but found - so sharing.

select UNIX_TIMESTAMP(ports_fdb.updated_at), ports_fdb.mac_address from ports_fdb join vlans on ports_fdb.vlan_id = vlans.vlan_id where vlans.vlan_vlan = 3333 AND UNIX_TIMESTAMP(ports_fdb.updated_at) >= UNIX_TIMESTAMP(NOW() - INTERVAL 15 MINUTE) HAVING count(ports_fdb.mac_address) > 10;