cthrace/bash-arpscan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Too lazy to check what exactly I did since last commit

Browse Source
This commit is contained in:
cthrace
2026-06-11 13:18:34 +02:00
parent 84cde06da2
commit 03a01c8c19
3 changed files with 209 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arpscan.sh
+46 -14
View File
@@ -7,9 +7,7 @@ starttime="$(date '+%Y-%m-%d %H:%M:%S')"
if [ -f arpscan.json ]
then
#tempjson=$(jq '.ips += {} | .ips = ([ .ips | to_entries[] | select(.value.reserved == true) ] | from_entries)' arpscan.json)
tempjson=$(jq '.ips += {} | .ips=(.ips|to_entries|map_values(.value.online=false)|from_entries)' arpscan.json)
#tempjson="$(cat arpscan.json)"
if [ $? -ne 0 ]
then
echo "Failed to load network JSON" 1>&2
@@ -24,18 +22,18 @@ jsonescape() {
}
foundhost() {
tempjson=$(jq "$(jsonescape "${1}") as \$ip|.ips[\$ip].mac=$(jsonescape "${2}")|.ips[\$ip].online=true" <<< "${tempjson}")
tempjson=$(jq "$(jsonescape "${1}") as \$ip|.ips[\$ip].mac=$(jsonescape "${2}")|.ips[\$ip].online=true|.ips[\$ip].lastseen=$(jsonescape "${starttime}")" <<< "${tempjson}")
}
doscan() {
local nmaplog
nmaplog=$(sudo nmap -sn -n 192.168.16.0/24)
nmaplog=$(sudo nmap -sn -n "${1}")
if [ $? -ne 0 ]
then
echo "nmap failed" 1>&2
return 1
fi
cat <<< "${nmaplog}" > nmaplog.txt
cat <<< "${nmaplog}" > "nmaplog.$(sed 's/\//\./' <<< "${1}").txt"
local parsestep
local ipaddr
@@ -97,20 +95,54 @@ doscan() {
#done < nmaplog.txt
}
doscan
if [ $? -ne 0 ]
then
echo "Scan failed" 1>&2
exit 1
fi
localifaces="$(ip -j addr | jq '[.[]|{ifname:.ifname,address:.address,addr_info:.addr_info[]}|select(.ifname!="lo")|select(.addr_info.prefixlen>=20)|select(.addr_info.family=="inet")|{ifname:.ifname,ip:.addr_info.local,prefix:.addr_info.prefixlen,mac:(.address|ascii_upcase)}]|map_values(.ip32=(.ip|split(".")|to_entries|map((.value|tonumber)*pow(256;3-.key))|add))|map_values(.subnet32=(.ip32/pow(2;32-.prefix)|floor)*pow(2;32-.prefix))|map_values(.subnet=([(.subnet32/pow(256;3)|floor%256),(.subnet32/pow(256;2)|floor%256),(.subnet32/256|floor%256),.subnet32%256]|join(".")))|map_values(del(.ip32)|del(.subnet32))')"
for i in $(seq "$(jq 'length' <<< "${localifaces}")")
do
currentiface="$(jq ".[${i}-1]" <<< "${localifaces}")"
foundhost "$(jq -r '.ip' <<< "${currentiface}")" "$(jq -r '.mac' <<< "${currentiface}")"
subnet="$(jq -r '.subnet' <<< "${currentiface}")/$(jq '.prefix' <<< "${currentiface}")"
echo "Scanning ${subnet}"
doscan "${subnet}"
if [ $? -ne 0 ]
then
echo "Scan failed" 1>&2
exit 1
fi
done
## make sure the MAC vendor and device/port fields exist
tempjson="$(jq '.macvendor+={}|.devices+=[]' <<< "${tempjson}")"
#tempjson="$(jq '.macvendor+={}|.devices+=[]' <<< "${tempjson}")"
if [ ! -f macvendor.json ]
then
echo '{}' > macvendor.json
fi
if [ ! -d devices ]
then
mkdir -p devices
fi
if [ ! -f devices/_example.json ]
then
cat <<EOF > devices/_example.json
{
"desc": "Description of the device",
"model": "Example Device Model",
"type": "example",
"user": "username",
"ports": [
{
"name": "port1",
"mac": "00:00:00:00:00:00"
}
]
}
EOF
fi
tempjson="$(jq '.ips=(.ips|to_entries|sort_by(.key|split(".")|to_entries|map((.value|tonumber)*pow(256;3-.key))|add)|from_entries)' <<< "${tempjson}")"
fancyjson="$(jq '. as $root|$root.macvendor|to_entries|map({key:.value[],value:.key})|from_entries as $vendors|($root.devices|map(.*(.ports[]|with_entries(.key|="port_"+.))))|map_values(del(.ports))|map({key:.port_mac,value:.})|from_entries as $ports|$root.ips|map_values(.port=$ports[.mac]|.vendor=$vendors[.mac[0:8]])' <<< "${tempjson}")"
fancyjson="$(jq --slurpfile macvendor macvendor.json --slurpfile devices <(cat devices/*.json) '. as $root|$macvendor[0]|to_entries|map({key:.value[],value:.key})|from_entries as $vendors|($devices|map(.*(.ports[]|with_entries(.key|="port_"+.))))|map_values(del(.ports))|map({key:.port_mac,value:.})|from_entries as $ports|$root.ips|map_values(.port=$ports[.mac]|.vendor=$vendors[.mac[0:8]])' <<< "${tempjson}")"
jq -r '(["[?]","MAC","Vendor","Model","IP","User","Device","Port"],(to_entries|sort_by(.key|split(".")|to_entries|map((.value|tonumber)*pow(256;3-.key))|add)|.[]|[if .value.online then "[#]" else "[ ]" end,.value.mac,.value.vendor,.value.port.model,.key,.value.port.user,.value.port.desc,.value.port.port_name]))|@tsv' <<< "${fancyjson}" | column -ts $'\t'
jq -r '(["[?]","IP","MAC","Vendor","Model","User","Device","Port","Last seen"],(to_entries|sort_by(.key|split(".")|to_entries|map((.value|tonumber)*pow(256;3-.key))|add)|.[]|[if .value.online then "[#]" else "[ ]" end,.key,.value.mac,.value.vendor,.value.port.model,.value.port.user,.value.port.desc,.value.port.port_name,.value.lastseen]))|@tsv' <<< "${fancyjson}" | column -ts $'\t'
cat <<< "${tempjson}" > arpscan.json