1

I unfortunately have DNS scavenging on; information I need to retrieve could have been in Event Viewer DNS logs, but that's not there anymore, or maybe I am not looking for it properly.

Story: I need to report on a machine who was throwing suspicious activity on our network. The activity occurred between a specific window of time. DNS/IP has since changed. All the information I've gotten from the security team is an IP and a window of time.

Question: Is there any other place I can get that log information and track down which machine had a specific IP at a specific time? I will also be asking networking to look on the switch/gateway side of things (maybe nail it down to Mac address or something), but I'm hoping I can find a way to verify from the system side. Any ideas?

3

You say the IP has changed, which sounds like you may be using DHCP to assign addresses? Check the DHCP log files C:\Windows\system32\dhcp. Use the time and the IP to find the MAC address, then use your inventory system to track down that asset. https://technet.microsoft.com/en-us/library/dd183591%28v=ws.10%29.aspx

  • DHCP is coming from the network core and not from the Windows box :( – TryTryAgain Jul 2 '15 at 15:35
  • Ask that team to check their log files for the IP/MAC address in use at that time. – Clayton Jul 2 '15 at 15:41
  • Marking this as accepted. My question wasn't clear enough, and in many cases Domain Controllers are still handling DHCP so this is a perfectly valid solution for anyone happening upon this topic in the future. – TryTryAgain Jul 2 '15 at 19:30
1

Resolution was to access the system logs of the machine which currently had that IP. It was an OSX machine and I was able to grep 'IP ADDRESS' /var/log/* /dev/null to find a log file which held historical IP information. I found that it was held in /var/log/daily.out and I was able to confirm the machine which currently held that IP had also had the same IP for the 3 previous days as well, answering my question and obtaining the information I needed.

NOTE: DHCP would be the place to check and @Craig620's answer is very much appropriate had I been running DHCP from a Windows server. I had networking look on the DHCP side and unfortunately they couldn't retrieve any logs and arp was dumped every 4 hours. Therefore, logs from the client side gave me what I needed, without needing to rely on server/network logs.

  • I don't like recommending our product here, but if this happens frequently then you may want to consider installing a software product which archives (DHCP) log files, makes them searchable, and also keeps a track of MAC to IP mappings. EventSentry (eventsentry.com) does just that and can potentially save you a lot of time. – Lucky Luke Jul 6 '15 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.