4

Possible Duplicate:
Find all past desktop IP addresses

I have a bunch of windows computers and due to a monitoring need I need to check their (static) ip address history.

When the user changes the ip address is there anywhere the ip address gets saved, logged or cached in any form at all? (I don't even need times, the simple ip address would do)

Improve this question
6
  • 1
    If the IP addresses are being changed, wouldn't they be considered Dynamic and not Static?
    – Django Reinhardt
    Dec 15, 2012 at 17:52
  • We have static ip addresses assigned to certain machines, but users seem to change them to use the network maliciously, its a bit difficult to get the mac address from the ip, but that a whole different question
    – Akshat
    Dec 15, 2012 at 17:55
  • im looking at static addresses not dynamic ones
    – Akshat
    Dec 15, 2012 at 17:57
  • 1
    xp?vista? win7? group policy? are they local admins?
    – Logman
    Dec 15, 2012 at 18:09
  • They are local admins, there isn't a group policy or domain controller being used with Win XP (for compatibility) and Win 7 computers
    – Akshat
    Dec 15, 2012 at 18:14

2 Answers 2

Reset to default
2

You could try the system event log. Filter for source 'iphlpsvc' and Event Id 4200.

EDIT: Turns out this only works on Server (2008R2), even though the 'IP Helper' service is running on Windows 7 as well, it seems it doesn't write anything to the event log.

I had 5 VMs open and picked the wrong one for the test, sorry.

I couldn't find anything in the service config to turn logging on, but that doesn't mean that's not possible, but you will not get past events.

Improve this answer
1
  • Didn't work for me, but Searching the Event log for events produced by such services (and perhaps your network adapter's drivers) are probably the best bet. You should add this answer to the linked duplicate. :)
    – Ƭᴇcʜιᴇ007
    Dec 15, 2012 at 18:23
1

When using TCP/IP on an Ethernet network the ARP traffic reveals physical address (MAC) to IP address mappings. This is done with various announcements and queries the results of which are often cached. A router will usually provide an easy way to list this information. In Windows for IP addresses contacted recently (so they are in the ARP cache) you can use ARP -a to list the information. A Windows AD domain controller is an example of such a machine.

Retrieving this information from a machine/router you control and logging it will even let you spot suspicious new MAC addresses should somebody start changing that as well.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .