Linux arp a

[jifox]

ISSUE TYPE

• New Template Pull Request

COMPONENT

linux_arp_a.textfsam, linux arp -a

SUMMARY

Parse arp-table arp -a on linux host

? (192.168.13.197) at 00:04:4b:cc:9c:ba [ether] on eth1.100
? (192.168.10.100) at <incomplete> on eth1.10
? (192.168.13.252) at 5c:e2:8c:fc:a4:74 [ether] on eth1.100
esxi (192.168.13.5) at 00:e0:67:05:9d:5a [ether] on eth1.100
? (192.168.13.253) at dc:f7:19:cd:d6:c4 [ether] on eth1.100
? (192.168.123.199) at 00:0f:c9:0e:c8:ec [ether] on eth0.21
? (192.168.10.52) at <incomplete> on eth1.10
? (192.168.10.7) at 00:0c:29:02:3b:93 [ether] on eth1.10
? (192.168.10.249) at 00:0c:29:bb:5f:a2 [ether] on eth1.10

---
parsed_sample:
  - hw_type: "ether"
    interface: "eth1.100"
    ip_address: "192.168.13.197"
    mac_address: "00:04:4b:cc:9c:ba"
    rev_dns: "?"
  - hw_type: "ether"
    interface: "eth1.100"
    ip_address: "192.168.13.252"
    mac_address: "5c:e2:8c:fc:a4:74"
    rev_dns: "?"
  - hw_type: "ether"
    interface: "eth1.100"
    ip_address: "192.168.13.5"
    mac_address: "00:e0:67:05:9d:5a"
    rev_dns: "esxi"
  - hw_type: "ether"
    interface: "eth1.100"
    ip_address: "192.168.13.253"
    mac_address: "dc:f7:19:cd:d6:c4"
    rev_dns: "?"
  - hw_type: "ether"
    interface: "eth0.21"
    ip_address: "192.168.123.199"
    mac_address: "00:0f:c9:0e:c8:ec"
    rev_dns: "?"
  - hw_type: "ether"
    interface: "eth1.10"
    ip_address: "192.168.10.7"
    mac_address: "00:0c:29:02:3b:93"
    rev_dns: "?"
  - hw_type: "ether"
    interface: "eth1.10"
    ip_address: "192.168.10.249"
    mac_address: "00:0c:29:bb:5f:a2"
    rev_dns: "?"

[jmcgill298]

@jifox thanks for your contribution. The only thing missing is the validation that all output was captured as expected.

[jifox]

Hi @jmcgill298

I've extended my set of test machines and saw that the cli output is translated on output. Therfore I've replaced the text constants ("at","on","auf") to \S+ so hopefully every language is accepted. I've also added regex for the -mac record.

I use the template already and it parses correctly, although the test is failing.

Value REV_DNS (\S+)
Value IP_ADDRESS (\S+)
Value MAC_ADDRESS (\S+)
Value HW_TYPE (\S+)
Value INTERFACE (\S+)

Start
^${REV_DNS}\s+(${IP_ADDRESS})\s+\S+\s+${MAC_ADDRESS}\s+[${HW_TYPE}]\s+\S+\s+${INTERFACE}$$ -> Record
^${REV_DNS}\s+(${IP_ADDRESS})\s+\S+\s+<${MAC_ADDRESS}>\s+\S+\s+${INTERFACE}$$ -> Record
^\s*$$
^. -> Error

[jmcgill298]

Should be fixed in jifox#1

[jifox]

Thx for support