Identifying MAC Addresses from DHCP Leases and Syslog in NIOS (1516)

This lab requires a NIOS 9.0 Lab Environment

This lab guide has been developed using the new NIOS 9.0 Lab Environment (experimental) lab. Please ensure that you deploy a NIOS 9.0 lab environment to complete these lab tasks. If you use a different lab environment, this is untested, and the lab likely will not work.

Scenario

A network troubleshooting task requires identifying the MAC address of a client that received a specific IP address via DHCP. However, the environment uses a DHCP failover configuration, and it's crucial to also determine which DHCP server issued the lease. You'll use the Grid Manager UI to investigate the DHCP lease table and analyze syslog logs to pinpoint the DHCP server involved in the lease assignment.

Estimate Completion Time

• 15 to 20 minutes

Credentials

Requirement

• Read-only access to Grid

Course References

• 1013: NIOS DHCP Failover Overview

Lab Initiation

Access jump-desktop

Once the lab is deployed, you can access the virtual machines required to complete this lab activity. To initiate the lab, click on the jump-desktop tile and login to the Linux UI:

Username: training

Password: infoblox

Initiate lab

To initiate the lab, double-click the Launch Lab icon on the Desktop.

Choose the lab number from the list and click OK.

After clicking OK, you will see a pop-up message with a brief description of the lab task. If the description looks correct, click Yes to continue lab initiation.

Lab initiation will take a couple of minutes to finish.

Once complete, you will see another pop-up message with the login credentials and the URL for the Grid Manager’s User Interface. Note that the credentials may differ from those from prior labs.

Tasks

Task 1: Requesting a DHCP Address

Log in to the testing-windows VM and use the necessary commands to release any existing IP address, if assigned. Then, request a new DHCP address for the Windows client using ipconfig /renew and verify the assigned IP address using the ipconfig command.

Task 2: Tracing DHCP Lease Source and Client MAC

Log in to the Grid Manager UI and navigate to the DHCP lease table. Use the IP address obtained in Task 1 to filter the table. In a DHCP failover environment, there may be two lease entries for the same IP. Use the lease details for each entry to determine the MAC address of the client and the DHCP server that issued the lease.

Task 3: Confirming Lease Assignment via DHCP Logs

From the Grid Manager UI, access the syslog logs for both failover members (ibns1.techblue.net and ibns2.techblue.net). Filter the DHCP logs using the IP address obtained in Task 1. Identify which server sent the DHCPACK message to confirm which DHCP server completed the lease assignment.

Solutions

Task 1 Solution: Requesting a DHCP Address

To request a new DHCP address, follow these steps:

1. Log in to the testing-windows VM using the default credentials:

   • Username: training

   • Password: infoblox

2. Open Command Prompt

   • Click on the Start menu.

   • Type cmd in the search bar.

   • Select Command Prompt from the search results to open it.

3. Use the command ipconfig /release and press ENTER in the Command Prompt.

4. This command releases the currently assigned IP address, returning the client to a 169.254.x.x address.

5. Use the command ipconfig /renew and press ENTER in the Command Prompt.

6. This command requests a new IP address from the DHCP server.

7. After the process is complete, use the command ipconfig again to verify that the client has received a new IP address.

8. Note the assigned IP address for use in the next task.

   

Note: The IP address shown in the screenshot may differ from the IP address the DHCP server provides to the Windows client during this lab.

Task 2 Solution: Tracing DHCP Lease Source and Client MAC

To identify the MAC address and lease source, start by accessing the DHCP lease table:

1. Log in to the Grid Manager UI.

2. Navigate to Data Management → DHCP → Leases.

3. Click Show Filter at the top of the table to enable filtering options:

   1. From the Choose Filter drop-down menu, select IP Address.

   2. From the Choose Operator drop-down menu, select equals.

   3. In the text field, enter the IP address obtained in Task 1.

   4. Click Apply to refine the results.

   5. In a DHCP failover setup, two entries for the same IP may appear.

   6. The MAC address is visible directly in the lease list.

      

4. Select an entry from the filtered list and click Lease Details.

   

5. In the Lease Details window, look at the "Served By" field.

   • This shows which DHCP server issued the lease to the client.

     

Task 3 Solution: Determine Lease Source from DHCP Logs

To confirm which DHCP server issued the lease, review the syslog entries for DHCPACK messages:

1. Log in to the Grid Manager UI.

2. Navigate to Administration → Logs → Syslog.

3. From the Member drop-down list, select ibns2.techblue.net.

4. Click Show Filter, then:

   1. In the first row of the filter section:

      • From the Choose Filter drop-down menu, select Server.

      • From the Choose Operator drop-down menu, select equals.

      • Select DHCP from the third drop-down menu.

   2. Add a second filter by clicking the + icon on the right.

      • In the new filter row, from the Choose Filter drop-down menu, select Message.

      • From the Choose Operator drop-down menu, select contains.

      • In the text field, enter the IP address obtained in Task 1.

   3. Click Apply to activate the filters and display only the relevant Syslog entries.

      

5. Review the filtered Syslog entries:

   • Look for log messages related to the DHCP lease process. Check if there is an entry where the server acknowledged an IP address to the client.

6. Repeat steps 3 to 5 for ibns1.techblue.net as well.

7. Determine which member completed the lease assignment by finding which one logged the DHCPACK message.

   • The member logging the DHCPACK entry is the server that issued the lease.