Network Monitoring, Static Addresses, and WiFi Extenders

In my previous post, I wrote about turning a Raspberry Pi into a network monitor, using Nagios and arpwatch. If you want to use Nagios to monitor networked equipment, then each piece of monitored equipment needs to have a static IP address--an IP address that never changes. Most networked devices are configured by default to request an IP address via DHCP (Dynamic Host Configuration Protocol) from the WiFi router, and by default, WiFi routers will assign a dynamic IP address--an IP address that might be different each time the device boots up.

There are two ways to go about assigning static IP addresses. You can configure each networked node's network interface, using whatever management tools the node might have. You'd have to manually configure each device, and you'd need to keep track of the IP addresses so that you don't accidentally assign two nodes the same address. You'd also want to be sure that all the IP addresses lie outside the range of dynamic addresses that your WiFi router doles out.

 

The easier, more centrally managed solution is to use your WiFi router to assign static addresses. Most WiFi routers let you configure static addresses that the router will assign via DHCP. This is probably a writable table of MAC (media access control) addresses and their corresponding static IP addresses, as in the image above--on this router, the table is called a DHCP reservations list. The beauty of this approach is that you only need to configure your WiFi router and then reboot your networked equipment. This is the method I used.

All went well--until I added a WiFi extender to our home network. We live in a split-level home, and our WiFi router sits on a shelf in a closet on the ground floor. Signal strength is not the best on the top floor. We'd recently visited some friends, who'd asked me to configure a new WiFi extender they'd bought, a TP-Link AC750. It wasn't hard to set up, and it seemed to work fine. Back at home, I decided to buy one for the top floor. When it arrived, I configured it and reconfigured a couple pieces of equipment to use the extender. The extender worked well, except that monitored devices that used the extender no longer were visible in Nagios. A quick glance showed that they'd new IP addresses, not their static IP addresses. What had happened?

 

I logged into our WiFi router's management interface and looked at the client status. I could see that the TP-Link had changed the MAC addresses of the devices that were using the WiFi extender. The TP-Link had substituted the first three bytes of its MAC address for the first three bytes of each device's MAC address. The simple fix was to change the MAC address in the DHCP reservations list to match the new MAC address the TP-Link was using.

I don't know whether the altering of MAC addresses by the TP-Link is common to all DHCP relays, or whether this is something unique to this brand of WiFi extender. In any case, although it's annoying to have to change the DHCP reservations list every time I switch a device from the WiFi router to the extender or vice-versa, it's not a difficult work-around.

Setting Up a Raspberry Pi 3 as a Home Network Monitor

I repurposed my Raspberry Pi 3 to monitor our home network. In the picture, it's the small black box underneath the white cable modem and to the right of the cable amplifier. I followed the steps outlined in the article "How to use Raspberry Pi to monitor network? (Nagios)" by Patrick Fromaget, at his website RaspberryTips. I ran into a couple of head-scratchers when I installed Pi OS Lite. Out of the box, the OS was configured for British keyboards, and it was a little tricky choosing the right options for my cheap wireless keyboard/trackpad. The other roadblock was that wi-fi was disabled. To enable it, I had to unblock it:

rfkill unblock wlan
shutdown -r now

I'd had some experience with Nagios, so I had no problems building and installing it from source, following Fromaget's instructions. I customized Nagios to monitor the temperature of the monitoring Pi. First, I added a /usr/local/nagios/libexec/check_cputemp executable. It's a shell script:

#!/bin/bash

cpu_lo_warn=-30
cpu_lo_crit=-40
cpu_up_warn=75
cpu_up_crit=85
cpu_temp=$(</sys/class/thermal/thermal_zone0/temp)
cpu_temp=$((cpu_temp/1000))

if [ -z $cpu_temp ]; then
  echo "UNKNOWN - Undefined CPU temperature"
  exit 3
fi
if [ $cpu_lo_crit -gt $cpu_temp ]; then
  echo "CRITICAL - CPU temperature $cpu_temp too cold"
  exit 2
fi
if [ $cpu_lo_warn -gt $cpu_temp ]; then
  echo "WARNING - Low CPU temperature $cpu_temp"
  exit 1
fi
if [ $cpu_temp -gt $cpu_up_crit ]; then
  echo "CRITICAL - CPU temperature $cpu_temp too hot"
  exit 2
fi
if [ $cpu_temp -gt $cpu_up_warn ]; then
  echo "WARNING - High CPU temperature $cpu_temp"
  exit 1
fi
echo "OK - CPU temperature $cpu_temp"
exit 0

Next, I added a check_local_cputemp command, by adding these lines to /usr/local/nagios/etc/objects/commands.cfg:

define command {

    command_name    check_local_cputemp

    command_line    $USER1$/check_cputemp
}

Then I added a CPU Temperature service to localhost, by adding these lines to /usr/local/nagios/etc/objects/localhost.cfg:

define service {

    use                     local-service
    host_name               localhost
    service_description     CPU Temperature
    check_command           check_local_cputemp
}

Then I restarted Nagios. Now, the services page has a CPU Temperature service for localhost.

I also wanted to monitor new equipment that might pop up on our home network, so I installed the  arpwatch and Postfix packages. I administered  a sendmail server for quite a few years, but that would be overkill for a network monitor. For information about installing and configuring Postfix to send outgoing mail, see Tutorial - Install Postfix to allow outgoing email on Raspberry Pi, at the Ste Wright website. Basically, I did a sudo apt-get install postfix and specified the Internet site and default hostname.

I installed arpwatch with sudo apt-get install arpwatch. Then I configured arpwatch to email me whenever anything new happened on the network, by creating the file /etc/arpwatch/wlan0.iface with the single line IFACE_ARGS="-m my@email.address" (where "my@email.address" is a valid email address to receive arpwatch messages). Then I issued the commands:

sudo systemctl enable arpwatch@wlan0
sudo systemctl start arpwatch@wlan0

For more information about configuring arpwatch, see How to monitor Ethernet Activity using Arpwatch tool, at LinuxHelp.

Once I had the Pi configured, I shut it down and mounted it, headless, on my crude network equipment board. It was easy, the classic Raspberry Pi case has two holes in the base for mounting. I plugged the power supply in, and it works!