https://github.com/evils/clarissa

A read-only mirror of https://gitlab.com/evils/clarissa
https://github.com/evils/clarissa

arp arp-scan census clarissa daemon ipv4 ipv6 libpcap ndp network

Last synced: 4 days ago
JSON representation

A read-only mirror of https://gitlab.com/evils/clarissa

• Host: GitHub
• URL: https://github.com/evils/clarissa
• Owner: evils
• License: bsd-3-clause
• Created: 2021-03-11T11:58:43.000Z (almost 4 years ago)
• Default Branch: main
• Last Pushed: 2023-03-19T03:01:14.000Z (almost 2 years ago)
• Last Synced: 2024-11-10T17:45:56.338Z (2 months ago)
• Topics: arp, arp-scan, census, clarissa, daemon, ipv4, ipv6, libpcap, ndp, network
• Language: C
• Homepage:
• Size: 306 KB
• Stars: 0
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.adoc
  • License: LICENSE

Awesome Lists containing this project

README

        
= clarissa(8)

include::docs/meta.adoc[]

== Values

Clarissa is an attempt at replacing https://github.com/sandb/pamela[Pamela]'s scanner with something that does not rely on scanning the entire network every so often.

The design goals are an ability to run *quietly* (without sending out packets at all), have better time resolution (arp-scan can trigger rate limiting) and make the output available locally.

* Running *quietly* imposes a practical minimum *timeout* of the longest time between packets from any device you want to keep track of.

* Better time resolution can be obtained by *nagging* devices.

* The output is a unix domain *socket* (`/var/run/clar/[interface]_[subnet]-[mask]` by default).

== Concept

* When a MAC address is found in a frame on the *listen* interface, it is saved along with a timestamp as an entry in an internal list.

** If this entry is already on the list, the timestamp is updated.

* Clarissa uses their timestamp and a set *timeout* to determine when to *nag* entries.

** When an entry has been *nagged* a set number of times, it is removed from the list on the next *interval*.

** If an IPv4 or v6 address was found, an entry gets *nagged* via ARP or NDP respectively.

include::docs/clarissa_options.adoc[]

include::docs/format.adoc[]

== Packages

The latest packages may be found https://evils.eu/clarissa/packages[here].