How to clear the DHCP GUI in OSX Server? Ghost clients in the building

dhcpdhcpdmac-osxmac-osx-server

I have a few client machines showing up in the network (not only in Server.app but also in various logs), which have "Computer Names" (Bonjour names in Apple-speak) which I don't recognize, but probably are old clients or more likely old names of active clients. I haven't yet been able to match the MAC addresses with newer Computer Names or hostnames in the logs, etc., either, and I don't have much historical data to work with for example previous, confirmed clients on the network.

To make things little weirder, the same clients show up in the logs of some Cisco switches, and are not always on the same floor of the building, which is strange because the MACs lookup by manufacturer to likely be iMacs. I see 2-4 of these fairly consistently, in a network where we have around 100 of similar iMacs, which would have all been imaged in a similar way, but do not have this cached data, or whatever it is.

It temporarily clears the names out of the dhcp list by turning off dhcp (in this case by using the GUI in Server.app), then deleting or editing /var/db/dhcpd_leases, and turning back on the service, but then they appear again after a few minutes. How can I remove them?… or should I have other network and/or security concerns?

Any tips more generically about how manage DHCP in Darwin/OSX on the command line, would help as well. The entire DHCP setup in Server.app seems buggy/laggy to me.

This question is in regards to a server with OSX Server 5.0 over OSX 10.11 running clients on 10.10 and 10.11.

Best Answer

The ghosts have been captured.

The real lesson here

...is to always fully research, overview, and document all new hardware in your networks.

Make time to proactively volunteer to set things up right the first time, even if it is not your sole responsibility, and even if your boss wants to setup the new devices.

Specific details

  1. In my case one client was a laptop from a former employee, now an outside consultant, whose machine was running on the wrong LAN, and had not been properly checked to be on that network; and the other client was a phone which had also not been confirmed and checked-in to my hardware lists. (The comment that both MAC numbers were iMacs was a mistake).

  2. My method of clearing DHCP on OSX Server, was correct; I've cited it again below.

  3. In regards to how manage DHCP on OSX & Darwin, especially on the command line, read on--I've self-answered and left a small trail of interesting links:

OSX DHCP Overview

The quintessential guie to Mac OS X Server Command-Line Administration, which is directly from Apple, albeit from a previous version of OSX, contains enough information about managing Macs from the command line to keep you busy reading through an entire vacation.

If that is not enough, there is also a massive article on OSX DHCP at Krypted.com.

Turning off DHCP (several methods are described just below) then deleting or editing /var/db/dhcpd_leases and turning back on the service, is indeed the best way to clear the leases.

You can turn off and on DHCP using the giant switch icon on the DHCP tab, at the upper-right of the screen, in the GUI of the current version of Server.app.

Alternatively, on the command line, you can execute (likely as root): serveradmin stop dhcp to stop DHCP and serveradmin start dhcp.

You can get loads of information about DHCP by typing:

serveradmin fullstatus dhcp

A Note about Bootstrap Protocol

For your log-reading pleasure, it is also important to know that Bootpd handles bootp instructions (internet bootstrap protocol), which is intertwined with DHCP, and the community of Wikipedians had the best definition I saw after a bit of searching about this relationship:

"... The Bootstrap Protocol (BOOTP) is a computer networking protocol used in Internet Protocol networks to automatically assign an IP address to network devices from a configuration server... While some parts of BOOTP have been effectively superseded by the Dynamic Host Configuration Protocol (DHCP), which adds the feature of leases, parts of BOOTP are used to provide service to the DHCP protocol. DHCP servers also provide the legacy BOOTP functionality."

This Technet article from Microsoft has also a very interesting comparison of the relationship between these two daemons, as well, for an additional resource.

You may also be able to use launchd, in a pinch, to essentially disable and re-enable DHCP, since DHCP depends on its services, for example, it's particular leases are stored at /etc/bootpd.leases, but contrary to old information floating around the web, this will not necessarily clear current versions of OSX Server DHCP information.

For example:

sudo /bin/launchctl unload -w /System/Library/LaunchDaemons/bootps.plist followed by sudo /bin/launchctl load -w /System/Library/LaunchDaemons/bootps.plist will restart the bootstrap service.

Related Topic