Evidence: DHCP Server Logs
Description: Collect DHCP Server Logs
Category: Applications
Platform: windows
Short Name: dhcpl
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
DHCP Server logs track IP address assignments, lease renewals, and client network activity. These logs maintain records of which devices connected to the network and when, mapping MAC addresses to IP addresses.
Data Collected
This collector gathers structured data about dhcp server logs.
Collection Method
This collector gathers DHCP log files from the Windows DHCP directory, including active and backup logs that record IP address lease information.
Forensic Value
DHCP logs help identify unauthorized devices on the network, track device movement, correlate network activity to specific machines, and establish timelines for when compromised systems were active on the network.
