#!/usr/bin/php -q
<?php

/*

	ArpMon - arpmon.php
	Reads PDML data from tethereal, and does arpwatch-like things using MySQL for the backend.

	Copyright (C) 2005 Brady Alleman.  All Rights Reserved.
	
*/

$debug = false;
if (isset($argv[2]))
{
	$debug = true;
	echo("Debugging enabled.\n");
}

// override php options
set_time_limit(0);

// open input process
if (!isset($argv[1]))
{
	die("Error: Required argument (interface) is missing.\n");
}
$int = $argv[1];
$fp = popen("/usr/sbin/tethereal -T pdml -n -i $int arp 2>/dev/null",'r');

// setup database connection
mysql_connect("localhost", "nettools", "your_database_password_here");
mysql_select_db("nettools");

// setup globals
$packet = false;
$proto = false;
$arp = array();
$lastmac = "";

function processAssociation($mac, $ip)
{
	GLOBAL $debug;

	$mac = str_replace(":", "", $mac);
	
	if ($debug)
	{
		printf("%s <-> %s\n", $mac, $ip);
	}

	$q = mysql_query("SELECT id FROM arp WHERE ip = INET_ATON('$ip') AND mac = CONV('$mac', 16, 10)");
	if (mysql_num_rows($q) > 0)
	{
		$r = mysql_fetch_array($q);
		mysql_query("UPDATE arp SET stamp=NOW() WHERE id={$r['id']}");
	}
	else
	{
		mysql_query("INSERT INTO arp SET ip = INET_ATON('$ip'), mac = CONV('$mac', 16, 10), stamp = NOW()");
	}
}

function startElement($parser, $name, $attr)
{
	GLOBAL $proto;
	GLOBAL $packet;
	GLOBAL $arp;
	
	if ($name == "PACKET")
	{
		$packet = true;
	}
	
	if ( ($packet) && ($name == "PROTO") && ($attr['NAME'] == "arp") )
	{
		$proto = true;
	}
	
	if ( ($packet) && ($proto) && ($name == "FIELD") )
	{
		$arp[$attr['NAME']] = $attr['SHOW'];
	}
	
}

function endElement($parser, $name)
{
	GLOBAL $proto;
	GLOBAL $packet;
	GLOBAL $arp;
	GLOBAL $lastmac;

	if ($name == "PACKET")
	{
		$packet = false;
	}
	
	if ($name == "PROTO")
	{
		$proto = false;
		if (count($arp))
		{
			if (($arp['arp.src.hw_mac'] != "00:00:00:00:00:00") && ($arp['arp.src.hw_mac'] != $lastmac))
			{
				$lastmac = $arp['arp.src.hw_mac'];
				processAssociation($arp['arp.src.hw_mac'], $arp['arp.src.proto_ipv4']);
			}
			$arp = array();
		}
	}
}

$xml_parser = xml_parser_create();
xml_set_element_handler($xml_parser, "startElement", "endElement");
$first = true;

while(!feof($fp))
{
	$line = fread($fp,4096);
	if ($first)
	{
		$line = "<main>" . $line;
		$first = false;
	}
	
	if (!xml_parse($xml_parser, $line, feof($fp)))
	{
		die(sprintf("XML Error (%s) at %d:%d.\n",  xml_error_string(xml_get_error_code($xml_parser)), xml_get_current_line_number($xml_parser), xml_get_current_column_number($xml_parser)));
	}
}

xml_parser_free($xml_parser);
fclose($fp);

?>