Alert when Wireless MAC address is seen on LAN

ASSUMPTIONS/DEPENDENCIES:

• All of your endpoints need to be in NPM inventory
• All of your endpoints have a True/False custom property called "Wireless"

SELECT DISTINCT Nodes.NodeID AS NetObjectID, Nodes.Caption AS Name
FROM Nodes
WHERE Nodes.Wireless = 0
AND Nodes.NodeID IN
  (SELECT NodeMACAddresses.NodeID
  FROM NodeMACAddresses
  WHERE NodeMACAddresses.NodeID IN
  (SELECT UDT_AllWLEndpoints.NodeID FROM UDT_AllWLEndpoints))

This should work as a Custom SQL Alert for Nodes.

I haven't taken a hard look at the UDT tables and views, but I am not 100% sure there will be something in there that marks devices as non-Wireless (so to speak). There are 2 main views for UDT endpoints: UDT_AllEndpoints and UDT_AllWLEndpoints...

    I *think* that the UDT_AllEndpoints holds all endpoints, not just the wired. And AllWLEndpoints holds all of the Wireless Endpoints.

So, it isn't as easy as saying "IF Wired.MAC = Wireless.MAC THEN Alert". But the above SQL will work if you take the time to add your endpoints and mark them with a custom property.

I'm hopeful someone in the community might be able to provide some insight into another part of UDT that might mark nodes as wired. If we can find that point, then it simplifies this considerably.

Good Luck!

-ZackM

Loop1 Systems: SolarWinds Training and Professional Services

• LinkedIN: Loop1 Systems
• Facebook: Loop1 Systems
• Twitter: @Loop1Systems

Z,

  We are not monitoring endpoints.  The wireless networks are essentially treated as "Guest Networks".  UDT logs all of the MAC Addresses that are seen on the wireless and tracks which APs they have been seen on.

Perhaps the approach is to look at each MAC address, alert if it has been both associated with an SSID, and seen on a port?

-ct

Z,

  We are not monitoring endpoints.  The wireless networks are essentially treated as "Guest Networks".  UDT logs all of the MAC Addresses that are seen on the wireless and tracks which APs they have been seen on.

Perhaps the approach is to look at each MAC address, alert if it has been both associated with an SSID, and seen on a port?

-ct