<?php
#requires nmap php-cli php-xml and run this as root.
#creates watched.json known.json (your notes) and watched.log
#purpose: something you can run easily and find new devices on your network.
#by meuon, very organic code. works and is sharable in current form.
#sins include using json files as a flat database, redundant variables.. etc..
$block = "192.168.77.0/24"; #edit for what you want to scan. This is suitable for SMALL networks.
ini_set('display_errors', 0); #comment this for debugging. I'm being lazy with some variables.
#If file exists: "boot.cnf.php" use it for config - I use this, you probably don't but can.
#$network='192.168.42.0' ;
#$cidr='24' ;
$filename = "boot.cnf.php"; #created manually or by another process
if (file_exists($filename)) {
    include ("boot.cnf.php");
    if (!empty($network)) {
        $block = "$network/$cidr";
    };
};
print "Watching block: $block\n";
$log = fopen("./watched.log", "a"); #open at beginning..
system("nmap -sP $block -oX /tmp/nmap.xml >/tmp/nmap");
$xmlfile = file_get_contents("/tmp/nmap.xml");
$xml = new SimpleXMLElement($xmlfile);
$json = json_encode($xml);
$json = preg_replace('/@/', '', $json);
$nmap = json_decode($json);
$lastwatched = file_get_contents("./watched.json");
$lw = json_decode($lastwatched, 1); #1 = assoc array
$known = file_get_contents("./known.json");
$known = json_decode($known, 1); #1 = assoc array
$i = 0;
$now = date("Ymd H:i:s");
$C = count($nmap->host);
foreach ($nmap->host as $n) {
    if ($i > $C - 2) {
        #print "Last $i  > $C-2\n" ; #cause the last of that XML aint.
        break;
    };
    $ip = $n->address[0]->attributes->addr;
    $mac = $n->address[1]->attributes->addr;
    if (!empty($n->address[1]->attributes->vendor)) {
        $vendor = $n->address[1]->attributes->vendor;
    } else {
        $vendor = '';
    };
    $new[$mac] = "$ip";
    if (empty($lw["$mac"])) {
        printf("FOUND:  %-18s %-16s %-20s %-20s\n", $mac, $ip, $vendor, $known["$mac"]);
        $captlog = sprintf("$now FOUND:  %-18s %-16s %-20s %-20s\n", $mac, $ip, $vendor, $known["$mac"]);
        fputs($log, $captlog);
        $FOUND[$mac]['mac'] = $mac;
        $FOUND[$mac]['ip'] = $ip;
        $FOUND[$mac]['vendor'] = $vendor;
        $FOUND[$mac]['known'] = $known[$mac];
    } else {
        printf("Known:  %-18s %-16s %-20s %-20s\n", $mac, $ip, $vendor, $known["$mac"]);
    };
    if (empty($known[$mac])) {
        $known[$mac] = "$vendor"; #makes it easy to edit the known file.. for me.
        
    }
    $i++;
};
#identify lost/missing
foreach ($lw as $key => $val) {
    if (empty($new["$key"])) {
        print "Lost: $key $val\n";
        $LOST[$key]['mac'] = $mac;
        $LOST[$key]['ip'] = $val;
        $LOST[$key]['known'] = $known[$key];
        $captlog = sprintf("$now LOST:   %-18s %-16s %-20s %-20s\n", $key, $val, '', $known["$key"]);
        fputs($log, $captlog);
    };
};
$newlastwatched = json_encode($new);
$fileout = fopen("./watched.json", "w");
fputs($fileout, $newlastwatched);
fclose($fileout);
$known = json_encode($known);
$known = preg_replace('/,/', ",\n", $known); #makes known.json easier to edit
$fileout = fopen("./known.json", "w");
fputs($fileout, $known);
fclose($fileout);
fclose($log);
if (!empty($FOUND) or !empty($LOST)) {
    print "\nLost and Found Summary:\n------------------------\n";
    if (!empty($FOUND)) {
        foreach ($FOUND as $d) {
            printf("FOUND:  %-18s %-16s %-20s %-20s\n", $d['mac'], $d['ip'], $d['vendor'], $d['known']);
        }
    }
    print "-----\n";
    if (!empty($LOST)) {
        foreach ($LOST as $d) {
            printf("LOST:   %-18s %-16s %-20s %-20s\n", $d['mac'], $d['ip'], '', $d['known']);
        }
    };
};