Reporting on DHCP denials due to IPV4 Fingerprint filter.

Posts: 2
2731     0


We are transitioning our end user BYOD phones/tablets to a separate WIFI network in our offices globally.  We implemented an IPV4 Fingerprint Filter for Smartphones/Tablets/Android/iOS to deny leases on the old DHCP Ranges to "assist" with the transition.


We are looking for a way to quantify the unique (MAC) denials on the old networks.


Are there any methods to report on DHCP denials due to a IPV4 Filter? 


I've tried creating a report but the DHCP Action values only include:  Renewed, Issued, Freed, Fixed, Abandoned ... there is no Deny.  To get my initial numbers i've been exporting the syslogs of 5 appliances to excel and distilling down to unique MACs, but this is too manual and time consuming to perform daily during this transition.


We are running NIOS 8.0.5 in our Grid, with a Reporting server, but no Data Collector currently.



Re: Reporting on DHCP denials due to IPV4 Fingerprint filter.

Posts: 129
2732     0

Hello Isora,


Are you indexing syslogs to the reporting server ? If yes, I believe the following search should be able to return unique MAC addresses for which leases were denied due to IPv4 filters :


Reporting -> Search ->


index=ib_syslog no permitted ranges with available leases | rex "^(?:[^ \n]* ){7}(?P<MAC_ADDRESS>[^ ]+) via (?P<RELAY_AGENT>[^ ]+)[^:\n]*:\s+\w+\s+(?P<NETWORK>[^:]+)" | table MAC_ADDRESS RELAY_AGENT NETWORK | dedup MAC_ADDRESS



Hope this helps.


Best regards,

Mohammed Alman.


Showing results for 
Search instead for 
Did you mean: 

Recommended for You