How can you scrape the current DHCP leases (static and non-static)...
-
@pwood999
I didn't know that file existed... But, that was the answer I was looking for. TY -
This gets me what I want:
egrep "lease|active|hardware|hostname" /var/dhcpd/var/db/dhcpd.leases -
This is even better:
egrep "lease|active|hardware|hostname" /var/dhcpd/var/db/dhcpd.leases | tr '\n{' ' ' | sed 's/lease/\nlease/g'
-
I spoke too soon, dhcpd.leases does not contain DHCP assigned static IPs.
I need those also.
-
@JustAnotherUser said in How can you scrape the current DHCP leases (static and non-static)...:
I need those also.
You man these : Services > DHCP Server >LAN, at the bottom of the page ?
They wind up in the main pfSense config file, /cf/conf/config.xml
and in the DHCP4v server config file (created from the main pfSEnse config file) /var/dhcpd/etc/dhcpd.conf -
Close, I want to see only active DHCP leases both dynamic and static. If I get inactive ones also, I can filter those out if there's an indication as to the state.
dhcpd.lease shows me only the dynamic leases.
config.xml & dhcpd.conf shows me the configured static leases but doesn't show whether they are active/inactive.
Surely, pfSense is saving active DHCP lease information somewhere.
-
See my foot note ;) => the DHCP server log ?!
There you will find the devices that asked for a lease, thus configured.
If they are "using" them ?
Diagnostics > ARP Table gives a clue, although the ARP cache will expire.
Another solution : for every lease configured : ping them. If there is an answer, the device uses the IP from the lease.A file with the info needed : not that I'm aware of.
-
@JustAnotherUser just out of curiosity, what is the end goal here - why do you want such a list? What are you going to do with it if you had it?
-
I have ALOT (a few hundred) of devices across several subnets both static and dynamic. At any given time, I want a text list of active devices so I can script for devices that have disconnected...
...and more importantly, find unknown devices that have joined the network.
I'd like to get MAC addresses so I can have a clue as to what the unknown are.
I could use something like nmap but, I would CONSTANTLY have to scan and unless I run nmap as root, I won't get the MACs.
The DHCP status page has all of that info on it, I just want an elegant way to grab the text from pfSense.
I'm guessing that all of the delicious creamy data is just sitting in an sqlite database or text file inside pfSense's bowels.
-
Could you use SNMP ? Not sure what is supported in PfSense, but the data could be there ?
Also have a look at arpwatch package ?
-
You've mentioned your solution yourself.
This :
@JustAnotherUser said in How can you scrape the current DHCP leases (static and non-static)...:
The DHCP status page has all of that info on it
makes me saying you : did you have a look ?
Just to see the "how it's done" part.
The end of the story, you've said it :@JustAnotherUser said in How can you scrape the current DHCP leases (static and non-static)...:
text file inside pfSense's bowels
Exact.
It's 'ISC DHCPd' so there is a /var/dhcpd/var/db/dhcpd.leases file, it's the scratchpad file of the dhcpd process.
It's a human readable ASCI file, ready to be parsed, awked, grepped, sedded, you name it. -
@JustAnotherUser couldn't you just look at the arp table? This would have all the info you need. For any network actually attached to pfsense.
Simple snmpwalk seems like you could just get this info via snmp
If the device is not in the arp table - it hasn't talked to pfsense for like 20 minutes which is the default cache time for arp entries. This is how the dhcp lease webpage shows if active or not.
keep in mind a couple of things, just because something hasn't talked to pfsense doesn't mean its not still on the network - maybe its just talking to something else on the same network.. If there is no gratuitous arp, or no arp for pfsense IP etc.. Then pfsense wouldn't really know if the device is there or not.. The only real way you could know if a device is still on the network would be to do arp scan, or if it answers ping, ping scan.
Also you mention other devices joining your network and knowing like the maker of said device - this is not always possible now a days with devices using random macs - both apple and android devices pretty much do this by default now.
-
@johnpoz
ARP table on one machine won't go across different network segments. -
@JustAnotherUser talking about the arp table on pfsense - the router.. did you notice the different IPs for what came back from my snmpwalk.. And that is just the small section of it.
