[shanekahkola]

I have searched several forums and found various flavors of my issue. However, I can't seem to get good resolution. So here's the problem:
I am writing an app that collects IP Accounting data from Cisco Routers. The app collects only the Source, Destination, bytes, and packets. All of this information is stored in a SQL database.

The output of the IPA data is timed (Cisco cron jobs). My IPAHandler needs to be able to resolve IP Addresses to host names. I am doing this with some releative ease, until it comes to local IP Addresses of machines that are not joined to the domain.

We are a college and we have several "rogue" notebooks on wireless. We would like to be able to capture the machine name of each device that gets an IP address - subsequently we would have their network usage data. But if I try to use the code listed below I get an error:

		static string Machine(IPAddress IP)
		{
			string sName = Dns.GetHostEntry(IP).HostName;
			return sName;
		}

Our AD only allows secure DNS updates, so a local IP address assigned to a non-domain machine does not show up in DNS and I get the following exception:
===========
No such host is known.
===========

Here's the question:

Can I query the DHCP server (an AD Domain Controller) for the IP Address and machine name? If so, do I need to use a WMI query, or is there an API I can use?

[snoj]

Well there isn't an DHCP option to get information on another node.

[shanekahkola]

snoj, on 19 Nov, 2009 - 09:37 PM, said:

Well there isn't an DHCP option to get information on another node.

Just to clarify,

The application will run on a server on the local network. I want to be able to access the DHCP entry infromation by querying a local AD DC based on the IP address of the entry. If I understand you correctly, you are stating that the DHCP server (Microosft DHCP) is not publicly available from a remote server for query.

Is it possible to do a WMI query for DNS entry information? Or, would i need a separate app that runs on that local DHCP server to get my information?

[baavgai]

DNS and DHCP don't really have anything to do with one another...

A DHCP server holds a block of addresses that it's willing to offer a requester. I request an address, I get given a number, and we're done. There are no "machine names" in this transaction. I could be a Windows box or a smart phone, it doesn't matter; though Microsoft DHCP servers can be picky about who they'll talk to. The next layer down, the only true identifying characteristic of the machine issued the IP address is it's MAC address. There are no names involved.

As you've noted, there is some voodoo that Windows does for Domain machines that talk to DHCP servers. That name does get registered, though not technically in DNS but rather in WINS.

If you have an IP address of an active machine on a network, you can ask it about itself. If it's a Windows machine, it will usually give you it's name. If the connection is not active then there's nothing to interrogate.

[shanekahkola]

baavgai, on 19 Nov, 2009 - 10:29 PM, said:

DNS and DHCP don't really have anything to do with one another...

...

If you have an IP address of an active machine on a network, you can ask it about itself. If it's a Windows machine, it will usually give you it's name. If the connection is not active then there's nothing to interrogate.

I realize that DNS and DHCP are two different things - though I do appreciate your informative approach. But, I also know that Microsoft's DHCP interface lists the machine name in its "leases" section. As a result, I was mainly asking if I could somehow access that information through an API or WMI query. DHCP is not security-locked for handing out addresses, but DNS is locked-down for creating entries. So, if a non-domain machine gets an IP address, it won't show-up in the DNS server. But, it will be in DHCP.

I suspect they are using WINS as well, but by nature of IP Accounting, the files may be processed while that node is offline. I would certainly entertain other creative ways of obtaining this information without being required to query that end-user machine directly.

Thoughts?

[baavgai]

The magic command for listing stuff is "netsh" and looks like:

netsh dhcp server 1.1.1.1 scope 1.1.1.0 show clients 1

However, that will only help you if you're on an OS that could be a DHCP server.

A more direct approach would be to call the DhcpEnumSubnetClients function: http://msdn.microsof...284(VS.85).aspx

I found a Powershell script that looks promising: http://poshcode.org/1477

If you want to use C#, you should be able to work from that.

Depending on your client, you'll probably have to track down some server components to get this to work. Good luck.

[shanekahkola]

Thank you very much. That's the kind of thing I was looking for. I'll mark this as a helpful solution, or question answered - whatever the affirmative is. I really appreciate your insight.