DHCP Scripting and Autorizations

by any chance do u have some sample scripts for DHCP server

I don't have a sample script but arpwatch can help you.

 Howto setup and configure Arpwatch on Debian Linux
http://just4fun.schule.at/jwein/arpwatch.html
 
Check if you have packets already installed:
 
    dpkg --status libpcap0.8
    dpkg --status arpwatch
 
If not already installed, install packets:
 
    apt-get install libpcap0.8
    apt-get install arpwatch
 
Create empty file for storing host information:
 
    vi /var/lib/arpwatch/arp.dat
 
Configure parameters:
 
    vi /etc/arpwatch.conf
 
insert line like this:
 
    eth0 -a -n 124.18.0.0/24 -m alerts.here@mydomain.com
 
Restart arpwatch for new configuration:
 
    /etc/init.d/arpwatch restart
 
Check if the process is running:
 
    ps ef | grep arpwatch
    root 218 1 0 11:38 ? 00:00:00 /usr/sbin/arpwatch ...
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:

i have windows box any thing for windows.

Okay, so...

You can do this with NetSh:

NetSh dhcp server scope 10.0.0.0 show clients

Where 10.0.0.0 would be replaced by the scope you're using. If you're unsure what that is, this command lists them:

NetSh dhcp server show scope

You can delete leases using:

NetSh dhcp server scope 10.0.0.0 delete lease <LeaseIP>

Bear in mind here that deleting the lease will not prevent the client using the IP, this is no help as a measure to prevent unauthorised access. You'd better have Conflict Detection enabled if you're deleting leases without booting the client off the network.

If those issues are not a problem in this scenario, all that's left is wrapping a script around this to compare client leases to entries in the database.

Chris

hi chris,

we are using ms sql server and we will wrap vb script  under c# program.

is there a way to match the lease.

will it give us the mac address as well
our end aim is to develop a NAC system which will then send an alert email for an unauthorized device.

If you're going for a more serious approach you should look at the DHCP API (or at least consider it), it's pretty well documented, although most of the nicer functionality isn't present until Windows 2008 R2.

http://msdn.microsoft.com/en-us/library/aa363376%28VS.85%29.aspx

More than enough available to do this though.

Using that in C# isn't so easy in my experience, everything uses Pointers, you'd have to permit Unsafe code. P/Invoke wrappers in C++ may be more appropriate, Marshalling some of the structures it returns is hard work in C# anyway (although it's possible that's due to my lack of experience with C# :)).

Anyway, the API is all NetSh is using, so don't feel constrained by scripting options if you can program this.

If you're sticking with a script called from we'd look at wrapping a text parser around the NetSh commands. That could match up the MAC addresses up. The IP Address and MAC are all returned by "show clients", I've attached an example of the output below (the MAC below is not modified to mask identity).

As you can see, it's rather messy, but not impossible to work with.

Finally, do note that you do not have to be local to the DHCP server to execute this command. Server names are an optional parameter of the "server" command. e.g.

netsh dhcp server \\SomeServer scope 10.0.0.0 show clients

Chris

C:\> netsh dhcp server scope 10.0.0.0 show clients
 
Changed the current scope context to 10.0.0.0 scope.
 
Type : N - NONE, D - DHCP B - BOOTP, U - UNSPECIFIED, R - RESERVATION IP
==================================================================================
IP Address      - Subnet Mask    - Unique ID           - Lease Expires        -Type
==================================================================================
 
10.0.0.1     - 255.255.255.0  - 00-0c-32-12-ff-ff   -03/11/2009 14:10:43    -D
 
No of Clients(version 4): 1 in the Scope : 10.0.0.0.
 
Command completed successfully.

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:

let me try this one will get back

this one works good
how ever do you have any idea if we can interrupt requests that are comming to DHCp for IP lease can any api's do that?

You'd have to act as a Firewall, sitting between the network layer and the DHCP service, catching and handling broadcast requests for addresses from clients. I couldn't tell you how to do that I'm afraid.

Have you considered or looked at Network Access Protection that MS shipped with Windows 2008 Server?

Chris