Is there a way to tell if a certain IP address is static or dynamic?

[Uclagamer_99]

Is there a way to tell if a certain IP address is static or dynamic?

Would a Reverse DNS lookup be able to confirm that an IP is in fact static?

 

[spidey07]

no. There isn't without access to the DHCP server.

 

[nweaver]

or you could sniff and watch for dhcp requests...

 

[spidey07]

Originally posted by: nweaver
or you could sniff and watch for dhcp requests...

provided you could actually "see" the requests. With modern networks it is next to impossible to catch layer2 broadcasts.

 

[mfriedkin]

Originally posted by: spidey07

Originally posted by: nweaver
or you could sniff and watch for dhcp requests...

provided you could actually "see" the requests. With modern networks it is next to impossible to catch layer2 broadcasts.

------------------------------------------------------------------------------------------------------
Spidey: Are you trying to say that broadcasts are not propagated to every port on a switched network ?

Again, I believe you need to go back to networking 101 class.

The definition of broadcast packets are those that are sent to every port on the entire L2 network. That is what they were designed to do.

M

 

[spidey07]

Originally posted by: mfriedkin

Originally posted by: spidey07

Originally posted by: nweaver
or you could sniff and watch for dhcp requests...

provided you could actually "see" the requests. With modern networks it is next to impossible to catch layer2 broadcasts.

------------------------------------------------------------------------------------------------------
Spidey: Are you trying to say that broadcasts are not propagated to every port on a switched network ?

Again, I believe you need to go back to networking 101 class.

The definition of broadcast packets are those that are sent to every port on the entire L2 network. That is what they were designed to do.

M

The request is a broadcast, the reply is not. So you wouldn't see the reply unless you were spanning the port.

And by modern networks I mean there are normally loads of routers to control the broadcast domain. Hence why it can be difficult to even see the broadcast.

 

[nweaver]

the request is all you want. A static client would not broadcast the request, and since you already know the IP address, you don't really need the reply.

This DOES require that you are on the same broadcast domain (i.e. no router between you and the ip you are sniffing for).

 

[spidey07]

Originally posted by: nweaver
the request is all you want. A static client would not broadcast the request, and since you already know the IP address, you don't really need the reply.

This DOES require that you are on the same broadcast domain (i.e. no router between you and the ip you are sniffing for).

good point. I can however see it as being really difficult to catch. You would have to capture the initial DHCP request (broadcast) because after that it is all unicast (including the renewals)

 

[nweaver]

ahh...you have a point, the renewal is unicast, so you would have to wait for a reboot or for a lease to expire w/o renewing before you could see it...


It's a valid way, but it's not a realistic way.