lan_abuse_detector

#!/bin/bash


GATEWAY=10.0.0.1
NETWORK=10.0.0.0/24
ADMIN_MAIL=lex@chou.it
LAN_IF=eth1
DUMP_DIR=/storage/log

reserved_ips() {
    fgrep 'fixed-address' </etc/dhcp/dhcpd.conf| sed 's/.*fixed-address \(.*\);/\1/'
    echo 10.0.0.223
}

capture() {
    lock="/tmp/$1.lock"
    if [[ ! -r $lock ]]
    then
        touch $lock
        dir="$DUMP_DIR/`date +'%Y-%m-%d'`/"
        mkdir -p $dir
        log="$dir/$1.traffic"
        trap "rm -f $lock;exit" SIGINT SIGTERM
        sudo tcpdump -i $LAN_IF host $1 -w $log 2> /dev/null
        rm -f $lock
    fi
}


if [[ "$1" == "capture" ]];then
  capture $2
  exit
fi



declare -A hosts
file='/tmp/device_log'
file_sum='/tmp/device_log.md5'
rm -f $file
touch $file $file_sum
hosts[$GATEWAY]=1
shopt -s lastpipe
reserved_ips | while read line
do
    hosts[$line]=1
done

nmap -sn $NETWORK | fgrep 'Nmap scan report' | sed  's/Nmap scan report for \([^(]*\)\( (\(.*\))\)\?/\1 \3/' | while read line
do
    host=$line
    ip=$line
    if [[ $line =~ ' ' ]];then
        host=${line% *}
        ip=${line##* }
    fi
    if [[ "${hosts[$ip]}" == "" ]];then
        echo "Unregistered host detected: $host $ip" >> $file
        sudo nmap -O --osscan-guess -Pn $ip >> $file 2>&1
        nohup $0 capture $ip >/dev/null 2>&1 &
    fi
done

if [[ -s $file ]]; then
    new_hash=`md5sum $file | sed 's/\s.*//'`
    old_hash=`cat $file_sum`
    if [[ "$new_hash" != "$old_hash" ]]; then
        echo $new_hash > $file_sum
        cat $file | mutt -s "WiFi compromised" $ADMIN_MAIL
    fi
fi