Hi Annie, You can see the leases in the dhcpd.leases file.
Make a copy to view. Jeremy -----Original Message----- From: Cisco Clean Access Users and Administrators [mailto:[EMAIL PROTECTED] On Behalf Of Annie Tennis Sent: Monday, January 07, 2008 9:54 AM To: [email protected] Subject: DHCP Records I had a security incident on my network on Friday afternoon (01/03). I am trying to track down a user via their IP address. When I login to the CAM, I am able to associate a user to the IP address but the login time occurred (01/04) after the incident occurred. However, I need to be certain that this user is indeed the user using the IP at the time of the incident. Is there a way I can look at the DHCP records? Thanks in advance. Annie Tennis Security Analyst Franklin College 317.738.8148
