Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any good FOSS tools to do an audit of reserved IPs used in a Linux/UNIX ISC DHCPd environment? I'm trying to ensure that we do not have stale IP addresses reserved when old MAC addresses are pulled.

share|improve this question
up vote 2 down vote accepted

The original question asked for FOSS tools for this purpose, but I'm not aware of any that do it just right.

I have had to perform this exercise in the past, so I can explain why some other suggestions here may not be enough. I'd ask what kind of routers you're using on your network.

  • Scanning the network at a particular time is not sufficient; it ignores the temporal aspect of use, among other things. Simply, a host may not be online while you did the scan. Another problem is that a host may have a firewall enabled to block the scan.

  • A human process... well, they're such squishy things, why would you want a human to do this?

  • Comparing DHCP conf to vended leases may be insufficient as well. The leases database would again have to be tracked over time. But the real problem is that you may have created an entry in your configuration which is being used statically, rather than via DHCP. Someone may have requested an address, found they could not configure DHCP properly, and hard-coded the address assigned to the machine.

The solution I used was to collect ARP records from (Cisco) routers. The minimal information you need to capture is IP address, MAC address and some temporal data (first seen, last seen) over some period of time. This could then be compared against your DHCP configuration to see which registrations are NOT being used and may be reclaimed. ARP logs reveal other information of use, such as

  • Registered MAC with registered IP address but no DHCP lease record -- host is hard-coded to their registration, not using DHCP.

  • Registered MAC not using registered IP address -- if on the same network, likely hard-coding to the wrong address; if on another network, host may have relocated.

  • Unregistered MAC with registered or unregistered IP address -- perhaps a new NIC, perhaps a rogue hard-coder.

You also need to create (and publish for users) a policy so the script that compares DHCP records with ARP information will nominate addresses to be reclaimed after some time N of non-usage. We used six months, though we did end up reclaiming an address of a staff member who went on sabbatical. Adjust as reasonable.

Hope this helps!

share|improve this answer

Per your comments to David's answer, it sounds like you need something to regularly poll the ARP tables on your default gateway and/or servers.

Some relatively simple Perl scripting of their SNMP tables should allow you to probe that, and build a long-term database of MAC -> IP mappings. See e.g.

share|improve this answer

I've no idea if or how well this works but it appears to collect some of the data you require so it could be a start.

share|improve this answer

If you mean dynamic allocation of leases, you don't have to do anything. The ISC dhcpd tries to hold on to previously assigned leases as long as possible until the lease pool is empty. It will then scavenge from expired (and therefore currently unused) leases.

If you mean static reservations, the answer is: human process.

You are cleaning up your DNS (and, if applicable, NIS) when old computers are decommissioned, right? So add a note to that process to clean up DHCP reservations at the same time.

In our case, we have a perl script that reads a specially formatted source file and generates NIS, DNS (forward AND backward), and DHCP tables automatically, distributes them, and notifies the serving daemons. This means we have one stop to clean up after ourselves and/or add something new.

share|improve this answer
I'm looking for something that helps the human process. That is the process that usually breaks down. So if I could see that hasn't had the fixed machine connect to it all year, I'd see that I may no longer need that reservation. The big problem is the networking staff may not be notified when some receives a new laptop. The laptop is not on the network all the time either so it is harder to track. – keithosu May 14 '10 at 13:11

I think you could put together a pretty simple perl script that would compare /etc/dhcpd.conf and /var/lib/dhcp/dhcpd.leases

I'd look at which seems to have modules for reading both of those types of files.

share|improve this answer

Another thought would be to capture and parse the output of a command like: nmap -sP -oG output.txt

If the command was run at Noon, or some other time when "everyone" should be on line it would likely capture the phantom laptop most of the time.

share|improve this answer

In places like schools and universities they register users based on their mac address, Tools like arpwatch have a database of static ARP entries. It is best to audit your network space prior to building an MAC address database. This is run on the NAT/DHCP gateway.

DHCP should not be depended on for network user management. What happens if someone picks a static IP?

Good luck, Ash

arpwatch is a computer software tool for monitoring Address Resolution Protocol traffic on a computer network. It generates a log of observed pairing of IP addresses with MAC addresses along with a timestamp when the pairing appeared on the network.

Network administrators monitor ARP activity to detect ARP spoofing. -- Wikipedia

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.