Need a shell scripter to develop mac/ipad/iphone detection routine

[WhateverFits]

Looks like 183 MAC ranges. Wow! I just yanked everything out of that list. It should be easy to write a script to compare.

[WhateverFits]

Not very efficient, but it works.

Code: [Select]

#!/bin/bash

# This script looks for Apple devices on the network and does something
# for every device that it finds.

if [[ $1 != "background" ]] ;then
        echo "Backgrounding ..."
        screen -d -m -S "AppleRadar" "$0" "background"
        exit 0
fi

## Loging function
function Log() {
        #echo "$(date) $*" >> /var/log/pluto/AppleScanner.log
        echo "$(date) $*"
}

apple_macs=( 00:03:93 00:0a:27 00:0a:95 00:0d:93 00:11:24 00:14:51 00:16:cb 00:17:f2 00:19:e3 00:1b:63 00:1d:4f 00:1e:52 00:10:fa 00:1e:c2 00:1f:5b 00:1f:f3 00:21:e9 00:22:41 00:23:12 00:23:32 00:23:6c 00:23:df 00:24:36 00:25:00 00:25:4b 00:25:bc 00:26:08 00:26:4a 00:26:b0 00:26:bb 00:3e:e1 00:c6:10 00:f4:b9 04:0c:ce 04:1e:64 04:54:53 0c:74:c2 0c:77:1a 10:40:f3 10:93:e9 10:9a:dd 14:5a:05 14:8f:c6 18:20:32 18:34:51 18:e7:f4 1c:ab:a7 24:ab:81 28:37:37 28:6a:b8 28:6a:ba 28:cf:da 28:e0:2c 28:e7:cf 34:15:9e 34:51:c9 3c:07:54 3c:d0:f8 40:30:04 40:3c:fc 40:6c:8f 40:a6:d9 40:d3:2d 44:2a:60 44:d8:84 48:60:bc 4c:b1:99 50:ea:d6 58:1f:aa 58:55:ca 58:b0:35 5c:59:48 60:33:4b 60:c5:47 60:fa:cd 60:fb:42 64:20:0c 64:b9:e8 64:e6:82 68:09:27 68:a8:6d 6c:c2:6b 70:73:cb 70:cd:60 70:de:e2 74:e1:b6 78:a3:e4 78:ca:39 7c:11:be 7c:6d:62 7c:c3:a1 7c:c5:37 7c:f0:5f 88:c6:63 8c:58:77 8c:7b:9d 90:27:e4 90:84:0d 98:03:d8 98:d6:bb a4:67:06 a4:b1:97 a4:d1:d2 b8:17:c2 b8:8d:12 b8:c7:5d b8:f6:b1 b8:ff:61 c0:84:7a c4:2c:03 c8:2a:14 c8:33:4b c8:bc:c8 cc:08:e0 d0:23:db d4:9a:20 d8:30:62 d8:9e:3f d8:a2:5e dc:2b:61 e0:b9:ba e0:f8:47 e4:ce:8f e8:04:0b e8:06:88 ec:85:2f f0:b4:79 f0:cb:a1 f8:1e:df fc:25:3f 00:88:65 04:15:52 04:26:65 04:f7:e4 10:1c:0c 10:dd:b1 1c:e6:2b 20:7d:74 28:cf:e9 2c:b4:3a 30:90:ab 30:f7:c5 34:c0:59 38:0f:4a 38:48:4c 3c:e0:72 40:b3:95 44:fb:42 4c:8d:79 54:26:96 5c:96:9d 60:fe:c5 64:a3:cb 68:9c:70 70:11:24 78:6c:1c 7c:fa:df 80:92:9f 84:fc:fe 88:1f:a1 88:53:95 88:cb:87 94:94:26 98:b8:e3 9c:04:eb a0:ed:cd a8:96:8a a8:fa:d8 ac:3c:0b b4:f0:ab b8:78:2e bc:3b:af bc:92:6b c8:6f:1d cc:78:5f d8:00:4d d8:d1:cb e4:25:e7 e4:8b:7f e8:8d:28 f0:d1:a9 f4:1b:a1 f4:f1:5a )

while : ;do


        arp_output=$( arp -n |fgrep -v incomplete |fgrep ether |tail -n +2|tr ' \t' '#')
        if [[ $? != "0" ]]; then
                arp_output=""
        fi


        for outputLine in $arp_output
        do
                #sleep 10
                ## Get the important info
                serverIP=$(echo $outputLine | tr '#' ' ' | awk '{print $1}')
                serverMAC=$(echo $outputLine | tr '#' ' ' | awk '{print $3}')

                Log "Processing $serverIP (mac: $serverMAC )"

                for mac in ${apple_macs[@]}
                do
                        mac_match="$mac.*"
                        count=`expr match "$serverMAC" "$mac_match"`
                        #echo expr match "$serverMAC" "$mac_match"
                        if [ "$count" -eq "17" ]
                        then
                                Log Found an apple product here: $serverIP
                                break;
                        fi
                done

        done

        ## Wait 60 seconds before doing another scan
        sleep 60
done


[tschak909]

Wow man, I will test this. Thanks

-Thom

[uplink]

Not very efficient, but it works.

Suggested efficient version of script:

Code: [Select]

#!/bin/bash

# This script looks for Apple devices on the network and does something
# for every device that it finds.

if [[ $1 != "background" ]] ;then
        echo "Backgrounding ..."
        screen -d -m -S "AppleRadar" "$0" "background"
        exit 0
fi

## Loging function
function Log() {
        #echo "$(date) $*" >> /var/log/pluto/AppleScanner.log
        echo "$(date) $*"
}

apple_macs=( 00:03:93 00:0a:27 00:0a:95 00:0d:93 00:11:24 00:14:51 00:16:cb 00:17:f2 00:19:e3 00:1b:63 00:1d:4f 00:1e:52 00:10:fa 00:1e:c2 00:1f:5b 00:1f:f3 00:21:e9 00:22:41 00:23:12 00:23:32 00:23:6c 00:23:df 00:24:36 00:25:00 00:25:4b 00:25:bc 00:26:08 00:26:4a 00:26:b0 00:26:bb 00:3e:e1 00:c6:10 00:f4:b9 04:0c:ce 04:1e:64 04:54:53 0c:74:c2 0c:77:1a 10:40:f3 10:93:e9 10:9a:dd 14:5a:05 14:8f:c6 18:20:32 18:34:51 18:e7:f4 1c:ab:a7 24:ab:81 28:37:37 28:6a:b8 28:6a:ba 28:cf:da 28:e0:2c 28:e7:cf 34:15:9e 34:51:c9 3c:07:54 3c:d0:f8 40:30:04 40:3c:fc 40:6c:8f 40:a6:d9 40:d3:2d 44:2a:60 44:d8:84 48:60:bc 4c:b1:99 50:ea:d6 58:1f:aa 58:55:ca 58:b0:35 5c:59:48 60:33:4b 60:c5:47 60:fa:cd 60:fb:42 64:20:0c 64:b9:e8 64:e6:82 68:09:27 68:a8:6d 6c:c2:6b 70:73:cb 70:cd:60 70:de:e2 74:e1:b6 78:a3:e4 78:ca:39 7c:11:be 7c:6d:62 7c:c3:a1 7c:c5:37 7c:f0:5f 88:c6:63 8c:58:77 8c:7b:9d 90:27:e4 90:84:0d 98:03:d8 98:d6:bb a4:67:06 a4:b1:97 a4:d1:d2 b8:17:c2 b8:8d:12 b8:c7:5d b8:f6:b1 b8:ff:61 c0:84:7a c4:2c:03 c8:2a:14 c8:33:4b c8:bc:c8 cc:08:e0 d0:23:db d4:9a:20 d8:30:62 d8:9e:3f d8:a2:5e dc:2b:61 e0:b9:ba e0:f8:47 e4:ce:8f e8:04:0b e8:06:88 ec:85:2f f0:b4:79 f0:cb:a1 f8:1e:df fc:25:3f 00:88:65 04:15:52 04:26:65 04:f7:e4 10:1c:0c 10:dd:b1 1c:e6:2b 20:7d:74 28:cf:e9 2c:b4:3a 30:90:ab 30:f7:c5 34:c0:59 38:0f:4a 38:48:4c 3c:e0:72 40:b3:95 44:fb:42 4c:8d:79 54:26:96 5c:96:9d 60:fe:c5 64:a3:cb 68:9c:70 70:11:24 78:6c:1c 7c:fa:df 80:92:9f 84:fc:fe 88:1f:a1 88:53:95 88:cb:87 94:94:26 98:b8:e3 9c:04:eb a0:ed:cd a8:96:8a a8:fa:d8 ac:3c:0b b4:f0:ab b8:78:2e bc:3b:af bc:92:6b c8:6f:1d cc:78:5f d8:00:4d d8:d1:cb e4:25:e7 e4:8b:7f e8:8d:28 f0:d1:a9 f4:1b:a1 f4:f1:5a )

declare -A apple_macs_assoc

for mac in "${apple_macs[@]}"; do
    apple_macs_assoc["$mac"]="$mac"
done

while : ;do


        while read serverIP skip serverMAC skip; do
                #sleep 10
                ## Get the important info

                Log "Processing $serverIP (mac: $serverMAC )"

                if [[ -n "${apple_macs_assoc["$serverMAC"]}" ]]; then
                    Log Found an apple product here: $serverIP
                    break;
                fi

        done < <(arp -n |fgrep -v incomplete |fgrep ether)

        ## Wait 60 seconds before doing another scan
        sleep 60
done

I haven't thoroughly tested my new script, but it appears to be doing what the original one did.

[WhateverFits]

I also improved the speed of mine this morning. Now I have to go and read what you did and compare. 

Code: [Select]

#!/bin/bash

# This script looks for Apple devices on the network and does something
# for every device that it finds.

if [[ $1 != "background" ]] ;then
        echo "Backgrounding ..."
        screen -d -m -S "AppleRadar" "$0" "background"
        exit 0
fi

## Loging function
function Log() {
        #echo "$(date) $*" >> /var/log/pluto/AppleScanner.log
        echo "$(date) $*"
}

apple_macs=( 00:03:93 00:0a:27 00:0a:95 00:0d:93 00:11:24 00:14:51 00:16:cb 00:17:f2 00:19:e3 00:1b:63 00:1d:4f 00:1e:52 00:10:fa 00:1e:c2 00:1f:5b 00:1f:f3 00:21:e9 00:22:41 00:23:12 00:23:32 00:23:6c 00:23:df 00:24:36 00:25:00 00:25:4b 00:25:bc 00:26:08 00:26:4a 00:26:b0 00:26:bb 00:3e:e1 00:c6:10 00:f4:b9 04:0c:ce 04:1e:64 04:54:53 0c:74:c2 0c:77:1a 10:40:f3 10:93:e9 10:9a:dd 14:5a:05 14:8f:c6 18:20:32 18:34:51 18:e7:f4 1c:ab:a7 24:ab:81 28:37:37 28:6a:b8 28:6a:ba 28:cf:da 28:e0:2c 28:e7:cf 34:15:9e 34:51:c9 3c:07:54 3c:d0:f8 40:30:04 40:3c:fc 40:6c:8f 40:a6:d9 40:d3:2d 44:2a:60 44:d8:84 48:60:bc 4c:b1:99 50:ea:d6 58:1f:aa 58:55:ca 58:b0:35 5c:59:48 60:33:4b 60:c5:47 60:fa:cd 60:fb:42 64:20:0c 64:b9:e8 64:e6:82 68:09:27 68:a8:6d 6c:c2:6b 70:73:cb 70:cd:60 70:de:e2 74:e1:b6 78:a3:e4 78:ca:39 7c:11:be 7c:6d:62 7c:c3:a1 7c:c5:37 7c:f0:5f 88:c6:63 8c:58:77 8c:7b:9d 90:27:e4 90:84:0d 98:03:d8 98:d6:bb a4:67:06 a4:b1:97 a4:d1:d2 b8:17:c2 b8:8d:12 b8:c7:5d b8:f6:b1 b8:ff:61 c0:84:7a c4:2c:03 c8:2a:14 c8:33:4b c8:bc:c8 cc:08:e0 d0:23:db d4:9a:20 d8:30:62 d8:9e:3f d8:a2:5e dc:2b:61 e0:b9:ba e0:f8:47 e4:ce:8f e8:04:0b e8:06:88 ec:85:2f f0:b4:79 f0:cb:a1 f8:1e:df fc:25:3f 00:88:65 04:15:52 04:26:65 04:f7:e4 10:1c:0c 10:dd:b1 1c:e6:2b 20:7d:74 28:cf:e9 2c:b4:3a 30:90:ab 30:f7:c5 34:c0:59 38:0f:4a 38:48:4c 3c:e0:72 40:b3:95 44:fb:42 4c:8d:79 54:26:96 5c:96:9d 60:fe:c5 64:a3:cb 68:9c:70 70:11:24 78:6c:1c 7c:fa:df 80:92:9f 84:fc:fe 88:1f:a1 88:53:95 88:cb:87 94:94:26 98:b8:e3 9c:04:eb a0:ed:cd a8:96:8a a8:fa:d8 ac:3c:0b b4:f0:ab b8:78:2e bc:3b:af bc:92:6b c8:6f:1d cc:78:5f d8:00:4d d8:d1:cb e4:25:e7 e4:8b:7f e8:8d:28 f0:d1:a9 f4:1b:a1 f4:f1:5a )

while : ;do


        arp_output=$( arp -n |fgrep -v incomplete |fgrep ether |tail -n +2|tr ' \t' '#')
        if [[ $? != "0" ]]; then
                arp_output=""
        fi


        for outputLine in $arp_output
        do
                ## Get the important info
                serverIP=$(echo $outputLine | tr '#' ' ' | awk '{print $1}')
                serverMAC=$(echo $outputLine | tr '#' ' ' | awk '{print $3}')
                serverMAC_sub=${serverMAC:0:8}

                Log "Processing $serverIP (mac: $serverMAC )"

                for mac in ${apple_macs[@]}
                do
                        if [ "$serverMAC_sub" == "$mac" ]
                        then
                                Log Found an apple product here: $serverIP $serverMAC
                        fi
                done

        done

        ## Wait 60 seconds before doing another scan
        sleep 60
done


[WhateverFits]

Wow uplink! Yours is distinctly faster than mine, even my improved version. However, it had two problems in that it bailed out at the first Mac MAC and was comparing full MACs not the range. I fixed it and here it is in wonderful efficiency! I have a couple of Macs here and my wife just turned one on without me knowing and it showed up in the list while I was testing it. That was a fun little break!

Code: [Select]

#!/bin/bash

# This script looks for Apple devices on the network and does something
# for every device that it finds.

if [[ $1 != "background" ]] ;then
        echo "Backgrounding ..."
        screen -d -m -S "AppleRadar" "$0" "background"
        exit 0
fi

## Loging function
function Log() {
        #echo "$(date) $*" >> /var/log/pluto/AppleScanner.log
        echo "$(date) $*"
}

apple_macs=( 00:03:93 00:0a:27 00:0a:95 00:0d:93 00:11:24 00:14:51 00:16:cb 00:17:f2 00:19:e3 00:1b:63 00:1d:4f 00:1e:52 00:10:fa 00:1e:c2 00:1f:5b 00:1f:f3 00:21:e9 00:22:41 00:23:12 00:23:32 00:23:6c 00:23:df 00:24:36 00:25:00 00:25:4b 00:25:bc 00:26:08 00:26:4a 00:26:b0 00:26:bb 00:3e:e1 00:c6:10 00:f4:b9 04:0c:ce 04:1e:64 04:54:53 0c:74:c2 0c:77:1a 10:40:f3 10:93:e9 10:9a:dd 14:5a:05 14:8f:c6 18:20:32 18:34:51 18:e7:f4 1c:ab:a7 24:ab:81 28:37:37 28:6a:b8 28:6a:ba 28:cf:da 28:e0:2c 28:e7:cf 34:15:9e 34:51:c9 3c:07:54 3c:d0:f8 40:30:04 40:3c:fc 40:6c:8f 40:a6:d9 40:d3:2d 44:2a:60 44:d8:84 48:60:bc 4c:b1:99 50:ea:d6 58:1f:aa 58:55:ca 58:b0:35 5c:59:48 60:33:4b 60:c5:47 60:fa:cd 60:fb:42 64:20:0c 64:b9:e8 64:e6:82 68:09:27 68:a8:6d 6c:c2:6b 70:73:cb 70:cd:60 70:de:e2 74:e1:b6 78:a3:e4 78:ca:39 7c:11:be 7c:6d:62 7c:c3:a1 7c:c5:37 7c:f0:5f 88:c6:63 8c:58:77 8c:7b:9d 90:27:e4 90:84:0d 98:03:d8 98:d6:bb a4:67:06 a4:b1:97 a4:d1:d2 b8:17:c2 b8:8d:12 b8:c7:5d b8:f6:b1 b8:ff:61 c0:84:7a c4:2c:03 c8:2a:14 c8:33:4b c8:bc:c8 cc:08:e0 d0:23:db d4:9a:20 d8:30:62 d8:9e:3f d8:a2:5e dc:2b:61 e0:b9:ba e0:f8:47 e4:ce:8f e8:04:0b e8:06:88 ec:85:2f f0:b4:79 f0:cb:a1 f8:1e:df fc:25:3f 00:88:65 04:15:52 04:26:65 04:f7:e4 10:1c:0c 10:dd:b1 1c:e6:2b 20:7d:74 28:cf:e9 2c:b4:3a 30:90:ab 30:f7:c5 34:c0:59 38:0f:4a 38:48:4c 3c:e0:72 40:b3:95 44:fb:42 4c:8d:79 54:26:96 5c:96:9d 60:fe:c5 64:a3:cb 68:9c:70 70:11:24 78:6c:1c 7c:fa:df 80:92:9f 84:fc:fe 88:1f:a1 88:53:95 88:cb:87 94:94:26 98:b8:e3 9c:04:eb a0:ed:cd a8:96:8a a8:fa:d8 ac:3c:0b b4:f0:ab b8:78:2e bc:3b:af bc:92:6b c8:6f:1d cc:78:5f d8:00:4d d8:d1:cb e4:25:e7 e4:8b:7f e8:8d:28 f0:d1:a9 f4:1b:a1 f4:f1:5a )

declare -A apple_macs_assoc

for mac in "${apple_macs[@]}"; do
    apple_macs_assoc["$mac"]="$mac"
done

while : ;do


        while read serverIP skip serverMAC skip; do
                #sleep 10
                ## Get the important info

                Log "Processing $serverIP (mac: $serverMAC )"

                serverMAC_sub=${serverMAC:0:8}

                if [[ -n "${apple_macs_assoc["$serverMAC_sub"]}" ]]; then
                    Log Found an apple product here: $serverIP
                fi

        done < <(arp -n |fgrep -v incomplete |fgrep ether)

        ## Wait 60 seconds before doing another scan
        sleep 60
done


[tschak909]

Thanks, uplink and Whateverfits!

-Thom