The easiest way to find out which system has requested the IP addresses from DHCP server is by examining the DHCP server logs (which can be located under %windir%\System32\Dhcp). Usually, a DHCP server log for server assignment will look like this:
In the format:
Where the first parameter, “10” is the DHCP server event ID, corresponding to "A new IP address was leased to a client" (full list of event ID’s can be found here).
However when a RAS server is assigned IP addresses by the server the log entries look slightly different:
It is almost identical, with the exception of the MAC address field, which is what we are looking for, if we want to identify the server receiving this IP address reservation. The field is too long, but it still has MAC address embedded in the string:
Where #'s represent a identifier number for the server, and
Now that you have the MAC address of the server that has requested the reservations, a method of identifying it is just a matter of preference - I personally like to do a reverse lookup in the core routers' ARP table, but if you don't have access to that, there are always applications such as CC Get Mac Address that will scan a specified subnet range and find the specified MAC address (think of it as a batch "nbtstat -A" tool).
Post a Comment