[Dnsmasq-discuss] Should every allocated (by DHCP) address be in /var/lib/misc/dnsmasq.leases?

[Chris Green]

On Wed, Jan 11, 2017 at 04:18:45PM +0000, Chris Green wrote:
> On Wed, Jan 11, 2017 at 04:54:33PM +0100, Albert ARIBAUD wrote:
> > Hi Chris,
> > 
> > Le Wed, 11 Jan 2017 15:09:54 +0000
> > Chris Green <cl at isbd.net> a écrit:
> > 
> > > I have a mystery IP on my LAN which looks as if it has been allocated
> > > by my dnsmasq process but it isn't in /var/lib/misc/dnsmasq.leases.
> > > 
> > > Is there anywhere else that I could look to see how/when dnsmasq
> > > allocated an IP?
> > >
> > > This is a small home LAN running on 192.168.1.xxx subnet with dnsmasq
> > > running on a raspberrypi.
> > 
> > If your dnsmasq's config has --log-dhcp, then you should find IP
> > allocations mentioned in your syslog (or whatever is systemd's
> > equivalent if applicable).
> > 
> No, I don't have --log-dhcp set, however there are some records in
> syslog like:-
> 
> Jan 11 07:28:25 pi dnsmasq-dhcp[2094]: DHCPREQUEST(eth0) 192.168.1.101 40:61:86:98:f2:41 
> Jan 11 07:28:25 pi dnsmasq-dhcp[2094]: DHCPACK(eth0) 192.168.1.101 40:61:86:98:f2:41 backup
> 
> However there's not the mystery one there.
> 
Searching further back finds it though, in syslog.1 :-

    Jan 10 15:16:14 pi dnsmasq-dhcp[2094]: DHCPDISCOVER(eth0) 8c:18:d9:a9:49:77
    Jan 10 15:16:14 pi dnsmasq-dhcp[2094]: DHCPOFFER(eth0) 192.168.1.91 8c:18:d9:a9:49:77
    Jan 10 15:16:14 pi dnsmasq-dhcp[2094]: DHCPREQUEST(eth0) 192.168.1.91 8c:18:d9:a9:49:77
    Jan 10 15:16:14 pi dnsmasq-dhcp[2094]: DHCPACK(eth0) 192.168.1.91 8c:18:d9:a9:49:77 android-95ce2ea664830932

My nmap utility reports:-

    192.168.1.1      vigor.zbmc.eu               00:50:7F:8B:35:40 (DrayTek)  
    192.168.1.2      pi.zbmc.eu                  B8:27:EB:22:D7:92 (Raspberry Pi Foundation)
    192.168.1.40     mikrotik.zbmc.eu            4C:5E:0C:73:87:3E (Routerboard.com)  
    192.168.1.60     fonera.zbmc.eu              C4:71:30:3E:63:4C (Fon Technology S.L.)
    192.168.1.81     C475IP.zbmc.eu              00:01:E3:9D:8B:B5 (Siemens AG) 
    192.168.1.90     android-688ad793c169b0ff.z  C8:AE:9C:1A:63:61 (Shanghai TYD Elecronic
    192.168.1.91                                 8C:18:D9:A9:49:77 (Shenzhen RF Technology)
    192.168.1.96     MC342-AE529C.zbmc.eu        00:25:36:AE:52:9C (Oki Electric Industry)
    192.168.1.101    backup.zbmc.eu              40:61:86:98:F2:41 (Micro-star Int'l) 
    192.168.1.124    maxine-X201.zbmc.eu         00:24:D7:6E:3D:08 (Intel Corporate) 
    192.168.1.130    DESKTOP-978VD5M.zbmc.eu     1C:1B:0D:60:9A:E1 (Unknown)  
    192.168.1.143    t430.zbmc.eu                8C:70:5A:E8:D3:18 (Intel Corporate) 
    192.168.1.3      esprimo.zbmc.eu           

So the Android device is still there but dnsmasq has expired it presumably, it is more than 24 hours
ago that it was allocated.

Phew, it's not an intruder!  :-)  (I didn't really seriously think it was)  I've just checked and it's
my Android 'reader', a rather strange Android device with a kindle type ePaper screen for reading 
rather than any other tablet functions.

-- 
Chris Green