Chris's Wiki :: blog/sysadmin/SysadminAphorismIV

Another aphorism of system administration

February 19, 2007

Noticing when something shows up is easy; detecting when it goes away is hard.

Like all aphorisms, this has exceptions. And if you want to see it that way, it's a corollary of an earlier aphorism.

(An aphorism brought to mind as I contemplate our DHCP configuration files and wonder just how many of those Ethernet addresses are currently mouldering in a dump somewhere.)

Comments on this page:

From 74.12.166.148 at 2007-02-21 19:16:05:

arpwatch can help with that. It keeps track of the last time a IP/MAC address was active on the network.

% grep ab:cd:ef arpwatch.log
0:0:0:ab:cd:ef | 192.168.xx.xx | UNKNOWN | Tue Oct 12 18:08:13 2004 | XEROX CORPORATION
(an old copier)

We've been running arpwatch since 2002. We usually assume that MAC addresses that have not shown up for more than a year are gone and we reuse their IP. Sometimes they are machines just collecting dust in a closet until someone decides to power them up again, arpwatch then warns you of "new activity".

OdR

Written on 19 February 2007.

«	Why we do NFS fileserving with a SAN

What I currently know about Fibrechannel versus iSCSI versus AoE