Flagging users who statically assign dhcp pool addresses

[Chuck Anderson]

On Tue, Jan 15, 2008 at 11:22:39PM +0000, Simon Hobson wrote:
> Troy Nissen wrote:
>> I had an interesting question proposed to me today, and I am unsure of the 
>> answer, so I thought I would post the question here.
>>
>> Is there a mechanism built into ISC DHCP that will flag a user if they 
>> have statically assigned their leased ip to their system?
>
> No.
>
> The only time it would show anywhere would be if the lease is expired and 
> the server wants to re-allocate the address. In that case, if you haven't 
> disabled "ping before offer", and the device isn't configured (eg firewall) 
> not to respond to pings, then you would get an abandoned lease which would 
> appear in the logs and the lease database.

You might troll the logs for DHCPDECLINE messages too.  In those 
cases, the client sent a DECLINE for the offered address because the 
client got a response to an ARP query for that address on the client's 
local network.  Usually that means someone statically set that 
address.