/usr/share/doc/arpalert/examples/scripts/send_alert.sh is in arpalert 2.0.12-1.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 | #!/bin/sh
#
# Arguments sent by ArpAlert are :
# 1 : MAC Address
# 2 : IP Address
# 3 : supp (used with unathrq alert)
# 4 : Type of alert (cf arpalert.conf)
#
# Intruder MAC address
intruder_MAC=$1
# Intruder IP address
intruder_IP=$2
# Extra parameter
intruder_Extra=$3
# Interface
intruder_Interface=$4
# Alert Type
intruder_AlertType=$5
# Vendor
if test ! -z "$6"; then
intruder_Vendor="$6"
else
intruder_Vendor="unknown mac vendor"
fi
# Mail recipient
mail_To="Jean Dupont <jdupond@domain.com>"
# Subject
mail_Subject="[Warning] Intrusion Detection [Warning]"
# Body and send mail
cat << EOF | mail -s "$mail_Subject" $mail_To
/!\ Intruder Detected /!\
Intrusion time stamp : $(date)
Intruder Ip Address : $intruder_IP
Intruder MAC Address : $intruder_MAC ($intruder_Vendor)
Intruder Extra info : $intruder_Extra
Intruder Interface : $intruder_Interface
Type of alert : $intruder_AlertType
EOF
|