Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Reporting

Reply

"DHCP scavenge" - Report for not-used DHCP Hosts

[ Edited ]
Authority
Posts: 15
3073     0

Hello,

 

After migration to an Infoblox Grid my customer asks if there is an opportunity to clean up the database in the future. The customer uses Host records for everything. Within this he uses the Fixed Address feature for the DHCP allocation of his devices. There are a lot of administrators and a lot of database entries over the years.

Is there an opportunity to mark not used Fixed Addresses/DHCP records when they were not used for over 6 months? Maybe the best way would be a report in Reporting & Analytics. The customer has one reporting appliance. Has anyone a source for the xml code for such a report?

 

Thank you very much.

 

Best regards, 

Sebastian

Re: "DHCP scavenge" - Report for not-used DHCP Hosts

Authority
Posts: 15
3073     0

Hello,

 

Maybe other people are also interested in this topic. After discussing the problem with Infoblox engineers I could now find out, that it is not possible to to get the list of fixed addresses into Splunk index/lookup table. Otherwise it would be possible to get the requested feature to analyze unused Fixed Addresses by the Reporting & Analytics Appliance.

 

If you want to push this topic you can add customers with usecase to the RFE-6937

Re: "DHCP scavenge" - Report for not-used DHCP Hosts

Techie
Posts: 6
3073     0

I have built this report prototype for my customer, due to infoblox limitation, i need to manually export the fixed address list and upload to the reproting server for the lookup comparison.

Re: "DHCP scavenge" - Report for not-used DHCP Hosts

Authority
Posts: 15
3073     0

That sounds good.

Could you describe your work in more detail? Do you export the Fixed Addresses over the API? How do you upload this to the Reporting Server and do the lookup comparison? Do you have a Network Insight appliance or where do you get the time, when the lease was used the last time?

 

Re: "DHCP scavenge" - Report for not-used DHCP Hosts

[ Edited ]
Techie
Posts: 6
3073     0

Sorry for the late response.

 

My customer did not purchase Network Insight since their core switch is using Chinese brand vendor such as Huawei.

 

for the fixed ip list, I just use manual operation to export the result.

CSV Job Manager > CSV Export > IPv4 Fixed Address

2021-02-19-111802

You can also use API to automate this process.

 

Once I got the latest fixed ip list, I can manually upload the file to Infoblox Reporting server:

Reporting Tab > Settings > Lookups > New Lookup table files. In my example, i renamed the file as fixedIP.csv and uploaded to the Lookup table files

2021-02-19-112354

 

Then, I created the report using the following logic:

1) ask for the user to select a period of time

2) set the IP ranges (prefix, subnet mask etc) to minimize the search

3) start the search

3a) lookup the fixed ip list ("fixedIP.csv") 

3b) filter fixed IP by the user inputed IP ranges (in the step 2)

3c) compare each IP in 3b with DHCP lease history where ACTION="fixed". if there is no match, this means the IP address is not leased during the pre-defined time period (in step 1)

Here is my demo dashboard:

2021-02-19-113527

 

 

Re: "DHCP scavenge" - Report for not-used DHCP Hosts

Techie
Posts: 6
3073     0

i am not sure why Infoblox community cannot show photo... 

 

you can view the photos here :

https://ibb.co/gdcRsG7
https://ibb.co/44qQVZD
https://ibb.co/nsWgsyz

Re: "DHCP scavenge" - Report for not-used DHCP Hosts

New Member
Posts: 1
3073     0

In a great contribution.

 

Can you share the report to me, so I can use it in my reporter?

Showing results for 
Search instead for 
Did you mean: 

Recommended for You