Fing network scanner
Of course that you can buy original Fingbox but that was not idea.
Motivation
I’m not paranoid about network security, but I wanted to know if some device joins my network. Idea is that I have some tool which will scan my local network each 30 minutes and see if any new, unknown, device is present and send notification to telegram with information about that device.
Setup
I created very simple bash script which I’m running on my Raspberry Pi 3. It can be also optimized but well, it’s working 
What I’m doing there?
Script runs Fing command line tool which returns CSV style table of all devices in defined network. Then for each row in that table I check if that device is present in ignoreddevices.txt file. If not then it checks knowndevices.txt file for that device and also checks if that device has still the same Ip address. This is useful if you didn’t setup static Ip address, then you will get notification if some of your devices changed Ip. Also this is useful against attacks when someone fakes your known device mac address.
Report for each device is published to MQTT.
Required libraries
First you have to install chkconfig tool.
sudo apt install chkconfig
Then you need to download Fing CLI.
https://www.fing.com/products/development-toolkit
I downloaded Fing CLI - Linux Debian - v5.5.2 zip and there you will find:
fing-5.5.2-arm64.deb which is needed for RPi 3 but there are other .deb files for all Linux distributions.
Install .deb file via dpkg or apt command:
sudo apt install path_to_deb_file
or
sudo dpkg -i path_to_deb_file
You need to install MQTT clients:
sudo apt install mosquitto-clients
and now you have all needed libraries.
Script
In network_tracker.sh script you have to put your data for:
-
net- network which will Fing search (mine is 192.168.0.0/24) -
mqtt_host- host for MQTT broker -
mqtt_user- MQTT user -
mqtt_password- MQTT password -
path to
knowndevices.txtandignoreddevices.txt
network_tracker.sh:
#!/bin/bash
net=192.168.0.0/24
mqtt_host=__your_mqtt_host__
mqtt_topic=networkTracker/alert
mqtt_user=__your_mqtt_username__
mqtt_password=__your_mqtt_password__
known=__path_to_knowndevices.txt__
ignore=__path_to_ignoreddevices.txt__
dt=`date '+%FT%T'`
IFS="
"
for l in `fing -n $net -r 1 -o table,csv --silent`
do
IFS=";"
array=($l)
fing_mac=${array[5]}
fing_ip=${array[0]}
fing_name=${array[6]}
if [ `cat $ignore | grep $fing_mac | wc -l` -eq "1" ]
then
echo "$dt - $fing_mac is ignored!"
continue
fi
if [ `cat $known | grep $fing_mac | wc -l` -eq "0" ]
then
echo "$dt - $fing_mac is not known!"
mosquitto_pub -h $mqtt_host -u $mqtt_user -P $mqtt_password -t $mqtt_topic -m "New Mac: $fing_mac IP: $fing_ip FingName: $fing_name"
elif [ `cat $known | grep $fing_mac | wc -l` -gt "1" ]
then
echo "$dt - $fing_mac has multiple records in knowndevices.txt"
mosquitto_pub -h $mqtt_host -u $mqtt_user -P $mqtt_password -t $mqtt_topic -m "Multiple records in knowndevices.txt for Mac: $fing_mac IP: $fing_ip FingName: $fing_name"
elif [ `cat $known | grep $fing_mac | wc -l` -eq "1" ]
then
knowndevice=($(cat $known | grep $fing_mac))
if [ "${knowndevice[1]}" != "$fing_ip" ]
then
echo "$dt - $fing_mac changed IP address from IP_OLD: ${knowndevice[1]} to IP_NEW: $fing_ip"
mosquitto_pub -h $mqtt_host -u $mqtt_user -P $mqtt_password -t $mqtt_topic -m "Mac: $fing_mac changed IP address from IP-OLD: ${knowndevice[1]} to IP-NEW: $fing_ip FingName: $fing_name DeviceName: ${knowndevice[2]}"
fi
fi
IFS="
"
done
knowndevices.txt:
34:e4:8b:72:96:f7;192.168.0.1;Ubee
34:e4:8b:72:97:f8;192.168.0.2;Device 1
In knowndevices file you have to put all your devices in format MAC_ADDR;IP_ADDR;FRENDLY_NAME. In my example you can see that I put my Ubee router mac: 34:e4:8b:72:96:f7 which is on IP 192.168.0.1 IP address and I put Ubee as Friendly name. Each device has to be in new row.
ignoreddevices.txt:
8c:30:75:36:9b:b5
In ignoreddevices file you have to put mac address of all devices which you don’t want to track. The above mac is just example.
I put network_tracker.sh script in cronjob. It will run it each xx:01 and xx:31. You have to use root cronjob or give Fing CLI root permissions.
1,31 * * * * path_to_scipt/network_tracker.sh >> path_to_logs/network_tracker.log
Home Assistant automation
I created automation which checks MQTT for network alerts and sends them to Telegram:
- alias: Network tracker
description: ''
id: 24b9f12c-b1b5-4899-b7f9-6078d6c8e775
mode: single
trigger:
- platform: mqtt
topic: networkTracker/alert
condition: []
action:
- service: notify.telegrambotme
data_template:
message: '🚨 NETWORK ALERT! 🚨 {{ trigger.payload }}'
Could you elaborate on that?
NETWORK ALERT!