Subject: MAC Address Tracking

From: "Brian Hamacher" <[email-masked]>
Date: Tue, 11 Dec 2012 16:04:14 -0600

I am looking for a good way to track my users MAC Addresses.  I have a
test DHCPv6 server up and running ISC 4.1.1-P1.  When I look through my
DHCP logs as well as my leases file I do not see the client MAC Address
anywhere.  Do I need to enable an option to allow this to be logged?  I
am looking to figure out how I can track what user had what IP Address
at any given time.  The MAC Address is traditionally how I have done
this.

Any thoughts would be appreciated.

Thank You

Brian

---

From: Philipp Kern <[email-masked]>
Date: Wed, 12 Dec 2012 16:37:25 +0100

> at any given time.  The MAC Address is traditionally how I have done

One way would be to poll your routers' ND tables (like fetching ARP tables
in IPv4). As soon as you use relaying you most certainly won't get a
useable MAC address from your client, even though it might be possible in
the same network segment. (The MAC address is not copied from the wire
into the new relayed packet sent by the router to your server.)

DHCPv6 uses the so-called client identifier extensively and not the MAC
address anymore. So you cannot do any static assignment based on MAC
addresses.

Kind regards
Philipp Kern

---

From: Tim Chown <[email-masked]>
Date: Wed, 12 Dec 2012 19:11:01 +0000

> address anymore. So you cannot do any static assignment based on MAC

Well there is this:
http://tools.ietf.org/html/draft-ietf-dhc-dhcpv6-client-link-layer-addr-opt-03

Not sure of implementations as yet, but three Cisco authors may be a clue.

We simply use a open source package that queries switch/router devices and builds the IP/MAC/port relationships from that.

Tim

---

From: Mark Smith <[email-masked]>
Date: Wed, 12 Dec 2012 12:09:38 -0800 (PST)

>________________________________
> From: Brian Hamacher <[email-masked]>
>To: [email-masked] 
>Sent: Wednesday, 12 December 2012 9:04 AM
>Subject: MAC Address Tracking
> 
>
>I am looking for a good way to track my users MAC Addresses.  I have a test DHCPv6 server up and running ISC 4.1.1-P1.  When I look through my DHCP logs as well as my leases file I do not see the client MAC Address anywhere.  Do I need to enable an option to allow this to be logged?  I am looking to figure out how I can track what user had what IP Address at any given time.  The MAC Address is traditionally how I have done this.
> 

Assuming MAC address = user is fundamentally assuming that a device is exclusively used by that one user. Mobile devices (e.g. tablets, smartphones) might suggest that assumption is becoming more true, however I think it actually might make it less true - mobile devices are also a lot easier to share or steal, than fixed location devices like desktop PCs. It might be worth considering moving to a user authentication model such as 802.1x to track your network users identities (i.e. use what they know to identify them, rather than what they have).

>--------------------------------------------------------------------
>IETF IPv6 working group mailing list
>[email-masked]
>Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>--------------------------------------------------------------------
>
>
>

---

From: Fernando Gont <[email-masked]>
Date: Thu, 13 Dec 2012 00:47:06 -0300

On 12/11/2012 07:04 PM, Brian Hamacher wrote:
> at any given time.  The MAC Address is traditionally how I have done this.

You may want to try ipv6mon: <http://www.si6networks.com/tools/ipv6mon>

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Raimundas Tuminauskas <[email-masked]>
Date: Thu, 13 Dec 2012 11:53:46 +0200

Dear Brian,

you might want to try
https://github.com/fln/addrwatch
it works the similar way as arpwatch, and is independent from any  
software (keeps track of privacy extensions, slaac, etc.) and as such  
has its own advantaged and downsides.

/Raimundas

> Any thoughts would be appreciated.

sincerely,
    Raimundas Tuminauskas
    KTU ITPI / LITNET NOC