Another aphorism of system administration

February 19, 2007

Noticing when something shows up is easy; detecting when it goes away is hard.

Like all aphorisms, this has exceptions. And if you want to see it that way, it's a corollary of an earlier aphorism.

(An aphorism brought to mind as I contemplate our DHCP configuration files and wonder just how many of those Ethernet addresses are currently mouldering in a dump somewhere.)

Comments on this page:

From at 2007-02-21 19:16:05:

arpwatch can help with that. It keeps track of the last time a IP/MAC address was active on the network.

% grep ab:cd:ef arpwatch.log
0:0:0:ab:cd:ef | 192.168.xx.xx | UNKNOWN | Tue Oct 12 18:08:13 2004 | XEROX CORPORATION
(an old copier)

We've been running arpwatch since 2002. We usually assume that MAC addresses that have not shown up for more than a year are gone and we reuse their IP. Sometimes they are machines just collecting dust in a closet until someone decides to power them up again, arpwatch then warns you of "new activity".


Written on 19 February 2007.
« Why we do NFS fileserving with a SAN
What I currently know about Fibrechannel versus iSCSI versus AoE »

Page tools: View Source, View Normal, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Mon Feb 19 17:39:32 2007
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.