monitor the list of connected clients via python

[photoangell]

I am trying to set up a realtime monitor of authenticated clients. The idea is that I have a raspberry pi that will give text to speech notifications when authorised clients join the network. for fun

I am quite happy with the raspberry pi and text to voice bit - but I am trying to find out a reliable way of monitoring my router (a RT-N66U) for the list of clients. The dnsmasq.leases file was one thought, but that just displays what leases have been given and not a current list of connections. I had thought about monitoring the syslog for DHCPDISCOVER requests, but it wouldn't provide me information when someone leaves the network.

What I am trying to access is similar to the screen in System Log -> Wireless Log. or on the home page under the View List button for clients.

I've dug around in the web interface asp files and reached a bit of a deadend in the C files (as I don't know C).

Has anyone done anything like this before - or can give me some pointers?

 

[miljbee]

Hello,

I also would like to get some sort of (almost) real time notifications when wireless clients get connected and disconnected.
I have tried via networkmap and client lists from nvram, but it's two slow. I think that the way to go is, as you wrote, finding the source of the Wireless log page.
I have searched a bit in the code and haven't found yet.

I would have liked the wireless AP to generate logs that could be sent to a custom syslog server, But I haven't yet find those logs and don't even know if they exist.

Could you post here if you find something please ? I will do the same.

Thanks

 

[miljbee]

After digging this forum a bit more, i found this one :
http://www.snbforums.com/threads/easily-get-connected-client-list.29310/

It tells that the commands
wl -i eth1 assoclist
wl -i eth2 assoclist

Will give you the list of associated clients. I have tried on my ac68u and it works.
Then you just have to integrate these commands in your scripts.

For the association events, you might also find it easier to check dhcp logs. I am using dnsmasq on a pi for that, and trapping dnsmasq-dhcp log entries from syslog seems to me easier. But of course, it won't work for disassociation.

I would really like to see the association and disassociation events from the APs in the syslog, it would allow to trap them easily with a remote custom syslog server. Perhaps it's just a matter of logging level. If someone knows I would really appreciate.

 

[ColinTaylor]

Hi Guys,

As you have said, using DHCP logs/events is not a reliable method. Firstly, a client can associate without using DHCP at all, and secondly there is no guarantee that a DHCP client will release its lease (in fact it probably won't - think device being powered off or moving out of range).

I don't think there are any disassociation "events" that can be trapped by a user program, so the assoclist seems to be the way to go. You can just poll the assoclist once a minute and do a "diff" between the "before list" and the "after list" to see who has joined and who has left.

 

[photoangell]

after digging around the web pages and c files, here's what I found (note my router is at 192.168.2.1)

the wireless log status is at
http://192.168.2.1/Main_WStatus_Content.asp
which makes an ajax call to http://192.168.2.1/ajax_wificlients.asp
which returns the kind of data I want
viewing the source of the page reveals it calls a function get_wl_status()
digging around the c code, I found (via ej_wl_status_2g_array) that this appears to get a lot of it's data from two key files. here's the relevant code snippet

/* Obtain mac + IP list */
arplist = read_whole_file("/proc/net/arp");
/* Obtain lease list - we still need the arp list for
cases where a device uses a static IP rather than DHCP */
leaselist = read_whole_file("/var/lib/misc/dnsmasq.leases");

doing some tests reveals that /proc/net/arp is exactly what I need, if you ssh into your router and run
cat /proc/net/arp
you get a list of clients, not all currently connected, so filter by the flag being 2 (connected)
cat /proc/net/arp | grep 0x2
you could compare this again the dnsmasq.leases to get machine name (matching on MAC), but as MAC is all I need I wont be doing that.

My next step is to write a python script to run on the raspberry pi which ssh into the router and monitors (via python package watchdog) /proc/net/arp for immediate notifications on association and dissociation....

 

[photoangell]

next stumbling block - can't use sshfs to connect to the router as sftp-server is not installed (and I don't want to modify the router if at all possible)...

I want filesystem like access so I can use python watchdog unless anyone else has better ideas for solving this...

 

[john9527]

Set up a cron job on the router to create the file to a Samba or NFS share on the router to be accessed by the pi?

 

[photoangell]

interesting idea, but I want realtime access if possible.

I have though about editing /tmp/etc/smb.conf (samba config) directly to create a share to the directory, feels risky though...

 

[photoangell]

well - that didn't work. I edited smb.conf, rebooted and it cleared my changes...

 

[ColinTaylor]

well - that didn't work. I edited smb.conf, rebooted and it cleared my changes...

You will have to use a smb.conf, smb.conf.add or smb.postconf file.

https://github.com/RMerl/asuswrt-merlin/wiki/Custom-config-files

 

[kvic]

I found /proc/net/arp not reliable. If you go with a method of polling, the one mentioned in #3 is very reliably and accurate.

I don't prefer polling, how often I want to poll? If the welcome voice arrives 5 seconds late, as a customer I'll feel a bit awk. If it arrives within 1 second, I'll feel sweet.

Given limitations of different approaches, I would still prefer the method of receiving DHCP events. It's asynchronous, timely and reliable enough. I assume customers won't cheat to defeat a warm welcome on purpose

 

[photoangell]

quick update - I tried sharing /proc/net out via smb.conf.add and while the directory shows up, all the files are zero length - so that's no good.

I tried using a custom script attached to DHCPC-Event but that doesn't trigger on mere association and dissociation. so I opted to run a cron job every minute - it's not very good, but it will do for now.

Cron job is added using cru as mentioned in this link https://github.com/RMerl/asuswrt-merlin/wiki/Scheduled-Reboot