DHCP Lease History
-
is there any way to learn which IP address used by a device with a MAC address?
-
Any help?
-
At least while connected, the device shows up on the status - dhcp leases screen… Is that not what you are looking for?
-
I think there is a button on the status page of the dhcp server that says "show all configured leases" that will show you all leases ever made
-
You probably want to send syslogs to a log server to log the logs you need logged.
-
The standard ISC-DHCPD that pfSense uses has no means of keeping a record of the lease history as far as I know.
-
If it's a current IP/MAC, then the DHCP Leases table would show it if it came from DHCP, or the ARP table (Diag > ARP) would show it even if it didn't come from DHCP, assuming that IP has talked to the firewall recently.
If it's not active now, the DHCP log might still have some info, but that depends on how busy the DHCP daemon is.
A program like arpwatch can help you keep an eye on those sorts of things over time.
