I’ve created a simple script in the /ip dhcp-server alerts submenu to notify me when it detects rogue DHCP servers. Is there anyway to have that same script include the MAC-Addresses and networks in the email?
Here’s the current script:
/tool e-mail send to="bill@domain.com" subject=([/system identity get name] . " found rouge DHCP server")
What I’m uncertain on is how do I pull that information from the router? The DHCP Alert automatically creates an entry in the log, if I could just pull that out from the log and send it in the body of the email that would be great.
Unfortunately, MT seems to be missing the ‘/ip dhcp-server alert get’ command, which would be needed to do it exactly as you describe, but…
You can do something very similar using the logger directly, no script needed:
/ system logging action add name="DhcpAlert" target=email email-to="foo@bar.com"
/ system logging add topics=dhcp,critical,error action=DhcpAlert disabled=no
With extra effort, a more advanced setup could be constructed using remote scripting (expect, or similar, triggered by a syslog event), but I don’t think it would really be worth it.
Just to add a little contribution. I tried following, and it worked too … Sends Email Alert of ROGUE DHCP using GMAIL ID
:local CurrentTime [/system clock get time];
:local hostname [/system identity get name]
:global date [/system clock get date]
:local int "$interface"
:local addr "$address"
:local mac $"mac-address"
/tool e-mail send server=173.194.69.109 port=587 start-tls=yes YOUR_GMAIL_ID@gmail.com password=YOURPASSWORD to=aacable@hotmail.com subject=DHCP-Detected body=("ROGUE DHCP Server have been detected on $hostname at $date - time $CurrentTime - Interface= $int - IP Address=$addr - MAC-Address= $mac !! GO HUNT & KILL :D")
To set GMAIL account
/tool e-mail set address=74.125.45.109 from=gmailid@gmail.com password=mypassword port=587 starttls=no user=gmailid
To view Email activity in LOG for troubleshooting purposes … enable email logs
/system logging add topics=e-mail action=memory
