At wit's end....(can't find dhcp leases)
p.mayers at imperial.ac.uk
Fri Sep 14 14:44:24 UTC 2007
> supposedly on the network. For example, we might be told that an ip
> address 10.1.1.100 was doing something bad on 09/13/2007 17:00:00 EDT.
> Then we go looking in the leases file and find out that the closest
> lease for that ip address on that day ended at 19:45:00 GMT (15:45:00
> EDT) and the next lease for it didn't start until 22:30:00 GMT
Unless you are using something like DHCP snooping in combination with
ARP or IP source guard on your switches, clients could in theory use any
IP they like.
The only way to be certain which IP is behind a given MAC is to log
changes to the ARP table.
More information about the dhcp-users