Orbi WiFi 7 RBE973
Reply

Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

cathyf
Aspirant

Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

I am trying to use the DHCP logs in my FVS336Gv3, and it's frustrating because the entries keep getting deleted out every few minutes. If I come back every few minutes and display the log and copy the stuff out into a text file, over time I can get a reasonably complete log. But I have an actual job to do, and can't spend my day clicking on links in the web interface and copying and pasting little chunks of text. Is this stuff getting saved somewhere?

 

To back up and say why I need this... When I look at the DHCP log I will see a line like

Jun 6 16:11:42 [FVS336GV3] local7.info [DHCPD]: DHCPACK on 10.10.10.10 to 6c:96:cf:b0:07:52 (BrittanysiPhone) via eth0.1

and what it will tell me is that the device on 10.10.10.10 with MAC 6c:96:cf:b0:07:52 is Brittany's iPhone. But when I come back, sometimes as short a time as 5 or 10 minutes later, those lines have been wiped out and there might be some more recent traffic. What I am trying to find is some way -- any way -- to look at a MAC address and find out what name it had whenever it was in the DHCP log before it got deleted from the display that I can see by clicking the DHCP Log link.

 

Is there any place that this information is being saved, and can I get to it?

Model: FVS336Gv3|ProSafe dual WAN gigabit firewall with SSL and IPSec VPN
Message 1 of 7
JohnC_V
NETGEAR Moderator

Re: Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

Hi cathyf,

 

Welcome to our community! 🙂

 

Logs are saved in the flash memory of the firewall and it just refreshed from time to time. Once you reboot the firewall, all the logs will be lost. I suggest you to enable and schedule emailing of logs so that it will automatically be sent to your email and have a copy of it.

 

Regards,

Message 2 of 7
cathyf
Aspirant

Re: Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

Thanks -- that's helpful!

 

I've got about a hundred of these routers at different sites. I've seen DHCP logs with entries going back as long as 3 days, but I have other sites where the DHCP log gets wiped out every minute or two. And it's not a matter of filling a buffer -- on some routers the log is a few hundred lines long, while on those where it's refreshing every minute there are never more that about 10 lines and often it's just empty. Is there a setting somewhere that I can lengthen the refresh cycle? Refreshing once per day would be great, a little longer even better.

 

As for emailing the logs to me, what I need is any line which contains a MAC address followed by the hostname -- I am trying to identify devices attached to the network. Of this list:

  • Change of time by NTP
  • Login attempts
  • Secure Login attempts
  • Reboots
  • All Unicast Traffic
  • All Broadcast/Multicast Traffic
  • WAN Status
  • Resolved DNS Names
  • VPN

will any of those give me those two pieces of information related to each other?

Model: FVS336Gv3|ProSafe dual WAN gigabit firewall with SSL and IPSec VPN
Message 3 of 7
JohnC_V
NETGEAR Moderator

Re: Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

@cathyf,

 

If you wanted to identify the devices attached to your network, you may also try to check the "View the Attached Devices". It includes the MAC address and the hostname.

 

Regards,

 

Message 4 of 7
cathyf
Aspirant

Re: Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

 I'm actually starting with the "Known PCs and Devices" shown on the LAN Groups listing, and what I am trying to find are the names of the devices which show up as "Unknown" in the LAN Groups. I know that if I go to the DHCP log, and am lucky and catch it before the router erases it, I can often catch DHCP traffic where it will show the MAC address followed by a host name in parentheses. (I have not figured out the exact rules for when a device shows up as "Unknown" in the "Known PCs and Devices" listing even though DHCP knows the device name, but it happens a lot.)

 

I'm looking for the host names that are in parentheses in the DHCP log when the "Known PCs and Devices" shows "Unknown". My problem is that the only place I know to find this info is behind the tedious manual web interface -- refreshing the DHCP log by clicking on buttons in the web page is a full-time job. If this information is in some other log or I can get it in some other way, that would be fabulous. If there is a way to get the contents of the DHCP log without continually pushing buttons on the user interface and then copy/pasting the lines into another file that would be fabulous. I don't need the full DHCP log -- I just need each name and the MAC address that goes with it.

 

I have tracked down a manual for the CLI at https://www.downloads.netgear.com/files/GDC/FVS336GV2/FVS336Gv2_CLI_20Mar2014.pdf (it's technically for the FVS336Gv2 and not the FVS336Gv3, but I have some FVS336Gv2s in addition to the several dozen FVS336Gv3s, and the CLI seems to work exactly the same on both devices.) This manual says that there is a command show net lan dhcp logs but when I run that command on the command line of either FVS336Gv2 or FVS336Gv3 it gives no output. 

 

FVS336Gv2> show net lan dhcp logs

FVS336Gv2>

 

FVS336Gv3> show net lan dhcp logs

FVS336Gv3>

(Other documented commands like show net lan dhcp leased_clients list give output that I expect. For that one I get a list of IPs and MACs but there are no names at all in that list.)

 

I am trying to build up a list of the host names that go along with the MAC addresses on my networks. The router clearly knows them, if even only briefly, but It seems that every trick I try to save this elusive hostname info is a dead end. 

Model: FVS336Gv2|PROSAFE DUAL WAN GIGABIT FIREWALL WITH SSL & IPSEC VPN,FVS336Gv3|ProSafe dual WAN gigabit firewall with SSL and IPSec VPN
Message 5 of 7
SamirD
Prodigy

Re: Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

I don't know exactly how much information you'll get from it, but I'd set up a syslog server and let the routers send debug information to the syslog server.  This way, you'll have the contigious information you need. 🙂

 

Message 6 of 7
cathyf
Aspirant

Re: Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

Actually I started a different thread about using the CLI (which is even more broken...) and in a followup gave some curl scripts for harvesting the DHCP info off the interactive page. 

 

https://community.netgear.com/t5/Hardware-VPN-Firewalls-and/FVS336Gv3-amp-FVS336Gv2-Is-there-a-trick...

Model: FVS336Gv2|PROSAFE DUAL WAN GIGABIT FIREWALL WITH SSL & IPSEC VPN,FVS336Gv3|ProSafe dual WAN gigabit firewall with SSL and IPSec VPN
Message 7 of 7
Discussion stats
  • 6 replies
  • 3304 views
  • 0 kudos
  • 3 in conversation
Announcements