2

I unfortunately have DNS scavenging on; information I need to retrieve could have been in Event Viewer DNS logs, but that's not there anymore, or maybe I am not looking for it properly.

Story: I need to report on a machine who was throwing suspicious activity on our network. The activity occurred between a specific window of time. DNS/IP has since changed. All the information I've gotten from the security team is an IP and a window of time.

Question: Is there any other place I can get that log information and track down which machine had a specific IP at a specific time? I will also be asking networking to look on the switch/gateway side of things (maybe nail it down to Mac address or something), but I'm hoping I can find a way to verify from the system side. Any ideas?

2 Answers 2

3

You say the IP has changed, which sounds like you may be using DHCP to assign addresses? Check the DHCP log files C:\Windows\system32\dhcp. Use the time and the IP to find the MAC address, then use your inventory system to track down that asset. https://technet.microsoft.com/en-us/library/dd183591%28v=ws.10%29.aspx

3
  • DHCP is coming from the network core and not from the Windows box :( Jul 2, 2015 at 15:35
  • Ask that team to check their log files for the IP/MAC address in use at that time.
    – Clayton
    Jul 2, 2015 at 15:41
  • Marking this as accepted. My question wasn't clear enough, and in many cases Domain Controllers are still handling DHCP so this is a perfectly valid solution for anyone happening upon this topic in the future. Jul 2, 2015 at 19:30
1

Resolution was to access the system logs of the machine which currently had that IP. It was an OSX machine and I was able to grep 'IP ADDRESS' /var/log/* /dev/null to find a log file which held historical IP information. I found that it was held in /var/log/daily.out and I was able to confirm the machine which currently held that IP had also had the same IP for the 3 previous days as well, answering my question and obtaining the information I needed.

NOTE: DHCP would be the place to check and @Craig620's answer is very much appropriate had I been running DHCP from a Windows server. I had networking look on the DHCP side and unfortunately they couldn't retrieve any logs and arp was dumped every 4 hours. Therefore, logs from the client side gave me what I needed, without needing to rely on server/network logs.

1
  • I don't like recommending our product here, but if this happens frequently then you may want to consider installing a software product which archives (DHCP) log files, makes them searchable, and also keeps a track of MAC to IP mappings. EventSentry (eventsentry.com) does just that and can potentially save you a lot of time.
    – Lucky Luke
    Jul 6, 2015 at 13:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .