Monitor when a device is connected to DHCP

[Tsonga]

Hi there,

 

Not sure where to put this so feel free to move if required,

 

I need to log when a device is connected to the network, I can obviously delete it's DHCP lease and check back later to see when it connected....and then delete it again, but I am looking for a solution that better logs the active times of this device.

 

Any suggestions?

 

Thanks

[Tsonga]

41 views and nothin'>

[Steve21]

Get it's MAC and check in the DHCP logs?

 

%system32%\dhcp\DhcpSrvLog...somethin

 

Should show everytime it's used DHCP up to about a week in the past I think by default

 

Steve

[pete]

One device, a handful of devices or all devices?

 

Assuming one device to a handful of devices and you want to know when they're actively connected to the network....

 

Assign a reserved IP, tell Nagios (or Cacti or whatever you're using) to monitor it via ping every "X" minutes, where "X" depends on the granularity you need. Then look at the pretty graphs it generates / nagios alert logs for those devices.

[Tsonga]

One device, a handful of devices or all devices?

 

Assuming one device to a handful of devices and you want to know when they're actively connected to the network....

 

Assign a reserved IP, tell Nagios (or Cacti or whatever you're using) to monitor it via ping every "X" minutes, where "X" depends on the granularity you need. Then look at the pretty graphs it generates / nagios alert logs for those devices.

 

You had my curiosity, but now you have my attention! Thanks

[Duke5A]

You could give this a try: VB Script to snoop DHCP logs - Blogs - EduGeek.net

 

The only issue I would see with using ping is if the host you're tying to monitor doesn't respond to ICMP requests. It would be best to parse the DHCP server logs.

[mac_shinobi]

You trying to stop this device(s) from accessing your network or what exactly ? Maybe give it a dhcp reservation with an ip address on the wrong range or assign it a static ip and you could ( if the device allows ICMP traffic ) do a constant ping to see when it is live and not.

[Danp]

In 2008R2 you can right click > deny, then they can't get another IP.

[Tsonga]

Hi guys, in the end I went with Robotest and setup a ping every 30 mins, exported this and made a pretty chart. Thanks for all your help.