DHCP lease log
Definition
A record maintained by a Dynamic Host Configuration Protocol server that maps each IP address assignment to the requesting device's MAC address, the lease start and end times, and often the device hostname. Used in investigations to determine which device held a given IP address at a specific time.
Related terms
- Anchor event
- A log entry that can be identified with high confidence across two or more log sources, used to verify relative clock offsets...
- Clock skew
- The difference between a device's local clock and a trusted reference time such as UTC. Skew accumulates due to hardware drift, timezone...
- Intrusion Detection System (IDS)
- A network or host-based monitoring system that analyses traffic or system behaviour against a rule set (signature-based) or a statistical baseline (anomaly-based)...
- Log normalisation
- The conversion of log entries from their native format into a common schema, typically a structured record with a corrected UTC timestamp,...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- NetFlow
- A network protocol (originally Cisco, now standardised as IPFIX under RFC 7011) that records metadata about IP traffic flows: source and destination...
- PCAP (packet capture)
- A file format (and the process of creating it) that records every byte of every network packet passing a capture point, including...
- RADIUS log
- An authentication, authorisation, and accounting record produced by a Remote Authentication Dial-In User Service server. Each entry records the username, authenticating device...
- Session tuple
- The five-element identifier for a network session: source IP, source port, destination IP, destination port, and protocol. The session tuple is the...
- Syslog
- A standardised protocol (RFC 5424) for transmitting log messages from network devices to a centralised log server. Routers, switches, firewalls, and servers...
Explained in these topics
- Network Evidence Sources and Their Forensic ValueA record maintained by a Dynamic Host Configuration Protocol server that maps each IP address assignment to the requesting device's MAC address, the lease star...
- Reconstructing a Network Timeline from Multiple SourcesA record maintained by a DHCP server that maps an IP address to the MAC address (and optionally the hostname) of the device that held that lease during a speci...