At wit's end....(can't find dhcp leases)

Tim Peiffer peiffer at umn.edu
Fri Sep 14 12:56:30 UTC 2007


I second the call to harvest your historical information and store it..  
DHCP lease and/or log files are only *one source* of many for an IP to 
exist on your network.  Pull all of that address tracking information 
together and put it into a tracking database.  Use the database to infer 
session dates <-> IP <-> MAC <-> port <-> access delivery jacks and then 
if you have machine registration, you can infer the binding of MAC <-> 
owner.

Tim Peiffer
Network Support Engineer
Networking and Telecommunications Services
University of Minnesota/NorthernLights GigaPOP

Bruce Hudson wrote:
>  
>   
>> My problem is this, and it's driving me crazy. Occasionally, we have
>> reason to go back and identify the mac address of a particular ip
>> address at a specific time. The obvious place to find this information
>> is in the leases file. However, it seems more and more often, we're
>> unable to find a lease for a particular ip address at the given time.
>> So, my question is twofold -- is anyone else seeing this particular
>> issue? And if so, are there any ideas why we might be seeing it? I
>> have some theories, but can't find anything on the internet to support
>> them.
>>     
>
>     The lease file only holds the information the server needs to do its
> job consistently across program restarts. It records active leases and it
> remembers the last IP address given to each identifier so that the server
> can give clients a consistent address if possible but this information is
> lost as soon as somebody else is given that address.
>
>     In addition, because the lease file is a text file with an "append
> and periodic rewrite", it does contain short-term historical information
> until its rewritten. 
>
>     We, as I suspect most people do, scrape historical information out
> of the log files and store it.
> --
> Bruce A. Hudson				| Bruce.Hudson at Dal.CA
> UCIS, Networks and Systems		|
> Dalhousie University			|
> Halifax, Nova Scotia, Canada		| (902) 494-3405
>   



More information about the dhcp-users mailing list