How to Monitor DHCP Client Activity in Linux

1. Overview

In this tutorial, we’ll discuss how to monitor DHCP client activity in Linux. We’ll learn a couple of methods for this purpose.

First, we’ll check the system logs for DHCP activity using journalctl. Secondly, we’ll add Bash tracing to the dhclient-script service script in order to get verbose output.

2. Monitoring DHCP Client Activity

There are a lot of DHCP server implementations available on Linux. However, the most commonly used ISC DHCP service is dhcpd. On the other hand, the ISC DHCP client implementation is dhclient.

dhclient doesn’t print any messages to the standard output unless we pass the verbose option to it:

$ dhclient --verbose
Listening on LPF/eno1/d4:be:d9:73:6e:88
Sending on   LPF/eno1/d4:be:d9:73:6e:88
Sending on   Socket/fallback
DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 4
DHCPOFFER of 192.168.10.17 from 192.168.10.1
DHCPREQUEST for 192.168.10.17 on wlp2s0 to 255.255.255.255 port 67
DHCPACK of 192.168.10.17 from 192.168.10.1
RTNETLINK answers: File exists
bound to 192.168.10.17 -- renewal in 37014 seconds.

When we run the command, dhclient detaches itself from the terminal session and runs in the background. At this point, dhclient has no mechanism for printing out logs to a log file that we can check later.

Fortunately, dhclient logs messages to the system logs, which we’ll cover next.

2.1. journalctl

There are lots of ways to check the system logs. The easiest one is to query the system logs using journalctl. If our server isn’t using journald, we can check the log files directly.

The output of journalctl can be lengthy, so we’ll narrow down our search to “dhcp”:

$ journalctl | grep -i dhcp
Oct 20 18:07:18 hey NetworkManager[396]: <info>  [1666271238.4616] dhcp: init: Using DHCP client 'internal'
Oct 20 18:07:18 hey NetworkManager[402]: <info>  [1666271238.6832] dhcp: init: Using DHCP client 'internal'
Oct 20 18:07:24 hey NetworkManager[396]: <info>  [1666271244.7307] dhcp4 (wlp2s0): activation: beginning transaction (timeout in 45 seconds)
Oct 20 18:07:25 hey NetworkManager[402]: <info>  [1666271245.7845] dhcp4 (wlp2s0): activation: beginning transaction (timeout in 45 seconds)
Oct 20 18:07:26 hey NetworkManager[396]: <info>  [1666271246.4533] dhcp6 (wlp2s0): activation: beginning transaction (timeout in 45 seconds)
Oct 20 18:07:26 hey NetworkManager[396]: <info>  [1666271246.7803] dhcp4 (wlp2s0): state changed new lease, address=192.168.10.9
Oct 20 18:07:27 hey NetworkManager[402]: <info>  [1666271247.8291] dhcp4 (wlp2s0): state changed new lease, address=192.168.10.9
...

Let’s use the tail command to get the latest 20 entries:

$ journalctl | grep -i dhcp | tail -n20
Nov 30 16:44:52 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 10
Nov 30 16:45:02 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 21
Nov 30 16:45:23 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 12
Nov 30 16:45:35 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 13
Nov 30 16:45:48 hey dhclient[3027]: No DHCPOFFERS received.
Nov 30 16:51:02 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 8
Nov 30 16:51:10 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 11
Nov 30 16:51:21 hey dhclient[3027]: DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 1
...

2.2. syslog File

The syslog file is a standard log file that contains detailed logs for network operations. Usually, this file is used by distributions that use some other type of logging system.

Typically, it’s located in /var/log under the filename syslog, and we can treat it as a plain text file that contains readable log entries.

2.3. Bash Tracing

Bash tracing allows us to debug bash scripts through verbose output. Technically, the Bash interpreter prints out the command it’s about to execute.

We can enable Bash tracing by passing the -x option to the bash command:

$ bash -x script.sh

We can apply this workaround to the dhclient-script file, which is basically a Bash script. First, let’s find out where the file is located:

$ whereis dhclient-script
dhclient-script: /usr/bin/dhclient-script /usr/share/man/man8/dhclient-script.8.gz

Now, let’s open this file in an editor and add the -x flag to the shebang:

#!/bin/bash -x
# dhclient-script for Linux. Dan Halbert, March, 1997.
# Updated for Linux 2.[12] by Brian J. Murrell, January 1999.
# No guarantees about this. I'm a novice at the details of Linux
# networking.
...

Now, when we execute the dhclient command, it displays each command on the standard output:

$ dhclient
+ ip=/sbin/ip
+ run_hook /etc/dhclient-enter-hooks
+ local script
+ local exit_status
+ script=/etc/dhclient-enter-hooks
+ '[' -f /etc/dhclient-enter-hooks ']'
+ '[' -n '' ']'
+ return
+ run_hookdir /etc/dhclient-enter-hooks.d
...

Here, we can see what decisions the code is making. Combining the Bash tracing option with the verbose option of dhclient prints out enough information to troubleshoot problems related to the DHCP client.

3. Conclusion

In this article, we learned a few methods to monitor the DHCP client activity in Linux.