Hands-On Network Forensics
上QQ阅读APP看书,第一时间看更新

Dynamic Host Configuration Protocol logs

Dynamic Host Configuration Protocol (DHCP) servers generally log entries when a specific IP address is assigned to a particular MAC address, when a lease was renewed on the network, the timestamp it renewed, and so on, thus having significant value in network forensics. The following screenshot of the router's DHCP table presents a list of dynamically allocated hosts: