I have a Debian Linux running on a RasPi. I'm looking for a way to run a script when another system becomes available on the network (aka logs in on my wifi AP). The AP is an AVM Fritzbox and as such can't do what I would like to achieve.

So I'd like to use one of the RasPis that I have available in my network to do this. It's always on and can monitor the network 24/7. Once a specific host logs into the network I'd like to run a script that for example notifies me of the event.

  • Something that periodically pings would suffice?
    – phk
    Oct 17 '15 at 10:00
  • It probably would... but merely as a last resort. I'd like to know whether there's something more "interrupting"... event based instead of polling. Oct 17 '15 at 10:49
  • @HendrikWiese: A device joining a network wouldn't create any event in itself that anything on the RasPi can act upon (except you can configure it do create some kind of event). If it uses static network configuration, it wouldn't even send a DHCP broadcast. You need some kind of polling to learn about the device.
    – Sven
    Oct 17 '15 at 10:57
  • Well, the network actually uses DHCP to assign IP addresses. So there has to be some DHCP broadcast. And other notification packages like zeroconf or something. Oct 17 '15 at 11:06
  • @HendrikWiese I don't see any possibility for anything event-based unless you do something on the AP. The AP is Linux-based, right? Do you have root access?
    – phk
    Oct 17 '15 at 12:19

There is a utility named dhcpdump, it listens on a network interface and dumps dhcp traffic, it can also filter by hardware address (MAC).

You could use that with a combination of grep to trigger your action.

On my laptop I used it to monitor via the ethernet the request of my phone (over wifi) for an IP address.

dhcpdump -i eth0 -h cc:05:1b:1d:8f:6d |tee dhcp3.log
cat dhcp3.log
TIME: 2015-10-17 14:21:25.079
    IP: (cc:5:1b:1d:8f:6d) > (ff:ff:ff:ff:ff:ff)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 00000000
  SECS: 65535
CHADDR: cc:05:1b:1d:8f:6d:00:00:00:00:00:00:00:00:00:00
OPTION:  53 (  1) DHCP message type         3 (DHCPREQUEST)
OPTION:  50 (  4) Request IP address
OPTION:  54 (  4) Server identifier
OPTION:  57 (  2) Maximum DHCP message size 1500
OPTION:  60 ( 13) Vendor class identifier   dhcpcd 4.0.15
OPTION:  55 (  9) Parameter Request List      1 (Subnet mask)
                                            121 (Classless Static Route)
                                             33 (Static route)
                                              3 (Routers)
                                              6 (DNS server)
                                             28 (Broadcast address)
                                             51 (IP address leasetime)
                                             58 (T1)
                                             59 (T2)


You can accomplish what you need with a simple shell script running tcpdump as shown below.

tcpdump -c 1 -nn '((port 67 or port 68) and ether host xx:xx:xx:xx:xx:xx)'

The above tcpdump run will wait until it captures one BOOTP/DHCP request from a client with MAC address matching xx:xx:xx:xx:xx:xx and exit. At this point, you can do what you need as you know the client you are interested in is connected to your network and asking for DHCP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.