Windows – How to Log MAC Addresses of Devices Acquiring IP via DHCP

dhcpipamwindows

My network serves DHCP through a Windows 2022 server. I would like to log the MAC addresses of all devices that acquire an IP address through this DHCP server. I have installed the IPAM role in the server, but I don't understand how to activate the logging. The server is standalone; it does not use Active Directory and it's not connected to a domain.

Best Answer

Get-DhcpServerv4Lease -ComputerName "dhcpserver.contoso.com" -ScopeId 10.10.10.0

Powershell can do this for you.

Get-DhcpServerv4Lease -ComputerName <MyDHCP> -ScopeId 192.168.0.0

In the output of this function, you will find the MAC address of the clients and the status of the leases as additional information.

This is for real time information.

You can view the logs of past events (once audit logging is enabled) via these steps:

To enable enhanced DHCP logging, perform the following steps:

Start the DHCP administration tool (go to Start, Programs, Administrative Tools, and click DHCP).
Right-click the DHCP server, and select Properties from the context menu.
Select the General tab.
Select the "Enable DHCP audit logging" check box

Lots of good information on DHCP audit logs here.

Related Solutions

Make Windows Server 2003 DHCP exclude a certain MAC

I think this might help

How to Filter MAC Address with Windows Server 2003/2008 DHCP Server Callout DLL

Dnsmasq: mapping 2 MAC addresses to the same IP address

(random semi-opinionated comment: it's rare to see this highish count of unconstructive and plain inaccurate answers and comments to a question)

In contrast to others here, I claim that your request is actually quite elementary and has been supported in dnsmasq since version 2.46, IIRC. This was the sole reason I switched from dd-wrt. After about a year of running OpenWRT, I now know there are actually plenty more reasons to switch, but that's beside the point.

I'm running Backfire 10.04-rc4:

May 23 17:45:16 gateway dnsmasq[1925]: started, version 2.55 cachesize 150

My configuration:

$ cat /etc/config/dhcp

config 'dnsmasq'
    option 'domainneeded' '1'
    option 'boguspriv' '1'
    option 'localise_queries' '1'
    option 'rebind_protection' '1'
    option 'rebind_localhost' '1'
    option 'expandhosts' '1'
    option 'authoritative' '1'
    option 'readethers' '1'
    option 'leasefile' '/tmp/dhcp.leases'
    option 'resolvfile' '/tmp/resolv.conf.auto'
    option 'enable_tftp' '1'
    option 'domain' 'domain.net'
    option 'local' '/domain.net/'

config 'dhcp' 'lan'
    option 'interface' 'lan'
    option 'start' '100'
    option 'limit' '150'
    option 'leasetime' 'infinite'

config 'dhcp' 'wan'
    option 'interface' 'wan'
    option 'ignore' '1'
    option 'dynamicdhcp' '0'

config 'dhcp'
    option 'interface' 'dmz'
    option 'start' '100'
    option 'limit' '150'
    option 'leasetime' '12h'

config 'host'
    option 'name' 'travelmate'
    option 'mac' '00:11:22:33:44:55 aa:bb:cc:dd:ee:ff'
    option 'ip' '192.168.1.111'

config 'host'
    option 'name' 'mobilitymac'
    option 'mac' '99:88:77:66:55:44 ff:ee:dd:cc:bb:aa'
    option 'ip' '192.168.1.104'

Enjoy the seamless transition this setup provides, all existing session stay alive if you don't take too long with the switch.

Best Answer

Related Solutions

Make Windows Server 2003 DHCP exclude a certain MAC

Dnsmasq: mapping 2 MAC addresses to the same IP address

Related Topic