0

I have quite few dhcp request from unlocated hosts, like:

dhcpd: DHCPDISCOVER from 00:25:90:54:91:b7 via eth0: network eth0: no free leases

Whats the best way to locate the host querying the dhcp?

I work in a respetable data center, with >2000 servers

Zhen
  • 2,159
  • 4
  • 19
  • 31

2 Answers2

5

Presumably your DHCP server is connected to a managed switch. If so, look at the MAC address table on the switch and find out what port the MAC address is "registered" to. Follow that port. If that port is an uplink port to another switch then do the same thing on that switch. If that switch isn't under your management control, ask the party who does manage it to find that MAC address in that switches MAC address table. Keep doing that until you find the host with that MAC address.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
  • I think this solution, but I was searching for an automated method, whatever – Zhen May 17 '12 at 11:05
  • Pointer: anything that can automate that without using vendor specific interfaces will likely be SNMP based. I do not know of any ready made tool for that, but you could likely use snmpwalk and scripting to build a solution that at least works with your setup. – rackandboneman May 17 '12 at 13:28
0

Talk to your network team, they should be able to traceroute the mac address and find the port and switch its plugged into, then you have to follow the wire.

Note that this layer 2 traceroute mac needs CDP enabled.

Sirch
  • 5,785
  • 4
  • 20
  • 36