Re: Network "Change Management"

Hi Dave and Folks,

The "canonical" solution is to put an IDS on a monitoring port on the 
Cisco.  That device will see all traffic on the switch and you can run 
something like arpd.  The nice thing about this is that there is no 
polling involved.  When a new PDU appears the arpd can take action 
immdiately.

Hope this helps.

Sam

Dave Torre wrote:

>Does anyone know of a Linux utility that can watch the MAC address
>tables in Cisco switches and alert admins as to when a new device has
>been plugged in?
>
>Basically, we have your standard client network with DHCP. Internet
>access is restricted to authenticated users, and so are the file shares.
>However, we've had a few instances where people just plug in their
>personal laptops which makes me very worried...
>
>Any thoughts/suggestions as to how I can monitor such events in real
>time?
>
>Thanks,
>-Dave
>  
>