At wit's end....(can't find dhcp leases)
Tim Peiffer
peiffer at umn.edu
Fri Sep 14 12:56:30 UTC 2007
I second the call to harvest your historical information and store it..
DHCP lease and/or log files are only *one source* of many for an IP to
exist on your network. Pull all of that address tracking information
together and put it into a tracking database. Use the database to infer
session dates <-> IP <-> MAC <-> port <-> access delivery jacks and then
if you have machine registration, you can infer the binding of MAC <->
owner.
Tim Peiffer
Network Support Engineer
Networking and Telecommunications Services
University of Minnesota/NorthernLights GigaPOP
Bruce Hudson wrote:
>
>
>> My problem is this, and it's driving me crazy. Occasionally, we have
>> reason to go back and identify the mac address of a particular ip
>> address at a specific time. The obvious place to find this information
>> is in the leases file. However, it seems more and more often, we're
>> unable to find a lease for a particular ip address at the given time.
>> So, my question is twofold -- is anyone else seeing this particular
>> issue? And if so, are there any ideas why we might be seeing it? I
>> have some theories, but can't find anything on the internet to support
>> them.
>>
>
> The lease file only holds the information the server needs to do its
> job consistently across program restarts. It records active leases and it
> remembers the last IP address given to each identifier so that the server
> can give clients a consistent address if possible but this information is
> lost as soon as somebody else is given that address.
>
> In addition, because the lease file is a text file with an "append
> and periodic rewrite", it does contain short-term historical information
> until its rewritten.
>
> We, as I suspect most people do, scrape historical information out
> of the log files and store it.
> --
> Bruce A. Hudson | Bruce.Hudson at Dal.CA
> UCIS, Networks and Systems |
> Dalhousie University |
> Halifax, Nova Scotia, Canada | (902) 494-3405
>
More information about the dhcp-users
mailing list