List Assigned DHCP IP Addresses

1. Overview

In this tutorial, we’ll learn commands that we can use to ask the DHCPD server to list assigned DHCP IP addresses. Before checking them out, we’ll discuss what DHCP is and its significance.

2. DHCP and DHCP IP Addresses

Dynamic Host Configuration Protocol (DHCP) is a client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address. It also provides other related configuration information, such as the subnet mask and default gateway.

The DHCP server maintains a pool of IP addresses and leases an address to any DHCP-enabled client. With DHCP, this entire process of assigning a unique unicast IP address to access the network and its resources is managed centrally and automated.        

3. Listing Assigned DHCPD IP Addresses

We can find the DHCP IP address associated with a server in different ways. Here are some of the commands we can use to find the IP Address of the DHCP server.

3.1. DHCPD Lease File

The dhclient keeps a record of leases in the dhcpd.leases file. This file also contains information about the DHCP server address. 

The ISC DHCP server’s .lease file path is:

/var/lib/dhcpd/dhcpd.leases

Let’s see the file’s content:

$ more /var/lib/dhcpd/dhcpd.leases
lease 192.168.1.100
{ 
starts 4 2022/07/22 20:27:28;
ends 1 2022/07/26 20:27:28;
tstp 1 2022/07/26 20:27:28;
binding state free;
hardware ethernet 00:1b:77:93:a1:69;
uid "\001\000\033w\223\241i";
}

Now, let’s discuss in little detail each parameter that appears in dhcpd.leases file.

•  lease ip-address { statements… }: Lease declaration starts here.
•  starts date; ends date: Starts and ends statements record the start and end time of a lease.
•  tstp: Tstp statement specifies the failover protocol.
•  hardware hardware-type mac-address: Hardware statement records the MAC address of the network interface that was used to acquire the lease.
•  uid client-identifier: The client’s identifier records the uid statement.
•  client-hostname “hostname” : Hostname records the client-hostname statement.
•  hostname “hostname”: If the client sends its hostname using the Hostname option, it is recorded using the hostname statement.

Alternatively, we can use the egrep command to filter out the DHCP server’s IP address:

$ egrep "lease|hostname|hardware|\}" /var/lib/dhcpd/dhcpd.leases
lease 192.168.1.10 { 
hardware ethernet 20:6a:8a:55:19:0a; 
client-hostname "Maryam-PC"; 
} 
lease 192.168.1.17 { 
hardware ethernet 00:16:ea:51:d3:12;  
client-hostname "parsoon"; 
} 
lease 192.168.1.13 { 
hardware ethernet 00:17:c4:3f:84:e3; 
client-hostname "zahra-ubuntu"; 
} 
lease 192.168.1.15 { 
hardware ethernet 58:b0:35:f1:31:2f; 
}

Another useful approach to list leases is by executing the dhcp-lease-list command that is a part of the isc-dhcpd package version 4.3.1:

$ dhcp-lease-list --lease /var/lib/dhcpd/dhcpd.leases

3.2. Evaluating All Active Leases

Most of the answers above are partial. And to be honest, there is no simple solution. We can parse the dhcpd.leases database file and get information on active leases, but without  FIXED addresses, assigned by a line like:

host switch1 { hardware ethernet a1:b2:c3:d7:2f:bc ; fixed-address switch1.mydomain.com; },

Nevertheless,  this information is incomplete. Parsing the dhcpd.leases file also does not give any information as to when was the last time a dhcp ack was sent to the machine. However, we can parse the dhcpd.log file to search for ack lines. They look like this:

2022-08-12T08:44:52.421114+01:00, Linuxx, info, dhcpd: DHCPREQUEST for 10.0.0.63 from 68:ab:35:59:9c:a1 via 10.0.0.1
2022-08-12T08:44:52.421174+01:00, Linuxx, info, dhcpd: DHCPACK on 10.0.0.63 to 68:ab:35:59:9c:a1 via 10.0.0.1

But, to obtain both, we can first parse the log file. Then, we can update the file for missing information like lease start-end, etc., with information obtained from dhcpd.leases file.

4. Listing Assigned DHCPCD5 IP Addresses

The format of the leases files is somewhat different when using DHCPCD5. For example, to view the lease, say, on richard01 for the WiFi network Richard123, we’d have to look at this file: 

/var/lib/dhcpcd5/dhcpcd-richard01-Richard123

As this file is binary, we can use the command dhcpcd –dumplease, which parses the binary from STDIN and outputs a human-readable version:

cat /var/lib/dhcpcd5/dhcpcd-richard01-Richard123.lease | dhcpcd --dumplease

Whereas, if we want to know the current lease assigned to richard01, we can simply:

dhcpcd --dumplease richard01

5. Using /var/log

A DHCP server sends a DHCPOFFER message to a client containing its IP address and the IP address that is offered to the client. This message gets logged in the /var/log file. We can find the DHCP IP Addresses of the server from /var/log using grep:

$ grep -IR "DHCPOFFER" /var/log/*

6. Using Journalctl

A DHCP server sends a DHCPACK message to a client containing its IP address and configuration information. Journalctl enables viewing and querying logs collected by systemd through /var/log file. Using journalctl with grep, we can find the IP Address of the DHCP server from the /var/log file:

$ journalctl | grep -m1 DHCPACK

7. Using the arp -a Command

ARP command is often used to resolve the IP address of a system to its mac address. We can as well get an approximate snapshot of DHCP leases via arp -a:

$ arp -a
Host                 Ethernet Address     Netif    Expire    Flags 
101.10.12.115        a4:bb:6d:e3:da:fc    em0      17m5s 
101.10.12.120        8a:6b:f2:8f:1a:43    em0      12m48s

8. Conclusion

In this article, we discussed some background on DHCP. We also discussed listing assigned DHCPD IP addresses using dhcpd.leases. Later, the other methods we discussed also help find DHCP IP addresses in a Linux system.