Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How can you scrape the current DHCP leases (static and non-static)...

    DHCP and DNS
    4
    16
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JustAnotherUserJ
      JustAnotherUser @JustAnotherUser
      last edited by

      @JustAnotherUser

      This gets me what I want:
      egrep "lease|active|hardware|hostname" /var/dhcpd/var/db/dhcpd.leases

      1 Reply Last reply Reply Quote 0
      • JustAnotherUserJ
        JustAnotherUser
        last edited by

        This is even better:

        egrep "lease|active|hardware|hostname" /var/dhcpd/var/db/dhcpd.leases | tr '\n{' ' ' | sed 's/lease/\nlease/g'

        1 Reply Last reply Reply Quote 0
        • JustAnotherUserJ
          JustAnotherUser
          last edited by JustAnotherUser

          I spoke too soon, dhcpd.leases does not contain DHCP assigned static IPs.

          I need those also.

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @JustAnotherUser
            last edited by

            @JustAnotherUser said in How can you scrape the current DHCP leases (static and non-static)...:

            I need those also.

            You man these : Services > DHCP Server >LAN, at the bottom of the page ?
            They wind up in the main pfSense config file, /cf/conf/config.xml
            and in the DHCP4v server config file (created from the main pfSEnse config file) /var/dhcpd/etc/dhcpd.conf

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            JustAnotherUserJ 1 Reply Last reply Reply Quote 0
            • JustAnotherUserJ
              JustAnotherUser @Gertjan
              last edited by JustAnotherUser

              @Gertjan

              Close, I want to see only active DHCP leases both dynamic and static. If I get inactive ones also, I can filter those out if there's an indication as to the state.

              dhcpd.lease shows me only the dynamic leases.

              config.xml & dhcpd.conf shows me the configured static leases but doesn't show whether they are active/inactive.

              Surely, pfSense is saving active DHCP lease information somewhere.

              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @JustAnotherUser
                last edited by

                @JustAnotherUser

                See my foot note ;) => the DHCP server log ?!
                There you will find the devices that asked for a lease, thus configured.
                If they are "using" them ?
                Diagnostics > ARP Table gives a clue, although the ARP cache will expire.
                Another solution : for every lease configured : ping them. If there is an answer, the device uses the IP from the lease.

                A file with the info needed : not that I'm aware of.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 1
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @JustAnotherUser
                  last edited by

                  @JustAnotherUser just out of curiosity, what is the end goal here - why do you want such a list? What are you going to do with it if you had it?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  JustAnotherUserJ 1 Reply Last reply Reply Quote 0
                  • JustAnotherUserJ
                    JustAnotherUser @johnpoz
                    last edited by JustAnotherUser

                    @johnpoz

                    I have ALOT (a few hundred) of devices across several subnets both static and dynamic. At any given time, I want a text list of active devices so I can script for devices that have disconnected...

                    ...and more importantly, find unknown devices that have joined the network.

                    I'd like to get MAC addresses so I can have a clue as to what the unknown are.

                    I could use something like nmap but, I would CONSTANTLY have to scan and unless I run nmap as root, I won't get the MACs.

                    The DHCP status page has all of that info on it, I just want an elegant way to grab the text from pfSense.

                    I'm guessing that all of the delicious creamy data is just sitting in an sqlite database or text file inside pfSense's bowels.

                    P GertjanG johnpozJ 3 Replies Last reply Reply Quote 0
                    • P
                      pwood999 @JustAnotherUser
                      last edited by pwood999

                      Could you use SNMP ? Not sure what is supported in PfSense, but the data could be there ?

                      Also have a look at arpwatch package ?

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @JustAnotherUser
                        last edited by Gertjan

                        @JustAnotherUser

                        You've mentioned your solution yourself.

                        This :

                        @JustAnotherUser said in How can you scrape the current DHCP leases (static and non-static)...:

                        The DHCP status page has all of that info on it

                        makes me saying you : did you have a look ?
                        Just to see the "how it's done" part.
                        The end of the story, you've said it :

                        @JustAnotherUser said in How can you scrape the current DHCP leases (static and non-static)...:

                        text file inside pfSense's bowels

                        Exact.
                        It's 'ISC DHCPd' so there is a /var/dhcpd/var/db/dhcpd.leases file, it's the scratchpad file of the dhcpd process.
                        It's a human readable ASCI file, ready to be parsed, awked, grepped, sedded, you name it.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @JustAnotherUser
                          last edited by johnpoz

                          @JustAnotherUser couldn't you just look at the arp table? This would have all the info you need. For any network actually attached to pfsense.

                          Simple snmpwalk seems like you could just get this info via snmp

                          snmp.jpg

                          If the device is not in the arp table - it hasn't talked to pfsense for like 20 minutes which is the default cache time for arp entries. This is how the dhcp lease webpage shows if active or not.

                          keep in mind a couple of things, just because something hasn't talked to pfsense doesn't mean its not still on the network - maybe its just talking to something else on the same network.. If there is no gratuitous arp, or no arp for pfsense IP etc.. Then pfsense wouldn't really know if the device is there or not.. The only real way you could know if a device is still on the network would be to do arp scan, or if it answers ping, ping scan.

                          Also you mention other devices joining your network and knowing like the maker of said device - this is not always possible now a days with devices using random macs - both apple and android devices pretty much do this by default now.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          JustAnotherUserJ 1 Reply Last reply Reply Quote 0
                          • JustAnotherUserJ
                            JustAnotherUser @johnpoz
                            last edited by

                            @johnpoz
                            ARP table on one machine won't go across different network segments.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @JustAnotherUser
                              last edited by johnpoz

                              @JustAnotherUser talking about the arp table on pfsense - the router.. did you notice the different IPs for what came back from my snmpwalk.. And that is just the small section of it.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.