DHCP Message Mapping

This topic contains information about supported fields in DHCP log messages for Universal DDI. It also contains corresponding field elements in CEF and LEEF formats via the syslog protocol and Splunk CIM via Splunk forwarder.

Note

NIOS DHCP is not supported at the current time.

CEF and LEEF messages use standard headers, as described below.

CEF Message header

CEF:0|Infoblox|Data Connector|1.0.0|DHCP-LEASE-$LeaseOp|DHCP Lease $LeaseOp|1

You can find LeaseOp values in the table below.

LEEF Message header

LEEF:1.0|Infoblox|Data Connector|1.0.0|DHCP-LEASE-$LeaseOp

You can find LeaseOp values in the table below.

The following table contains supported fields in DHCP logs for Universal DDI and their corresponding field elements for other supported message formats.

Internal field	Product	CEF	LEEF	Splunk CIM	Description
Cltt	B1DDI	timestamp*	timestamp*	timestamp*	Date/Time
	B1DDI	cat	cat		DHCP Lease $LeaseOp
	B1DDI	app	app		DHCP
NIOS-X Server (based on NIOS-X ServerID)	B1DDI	InfobloxNIOS-X Server	InfobloxNIOS-X Server	infoblox_NIOS-X Server	NIOS-X Server name of the DHCP server (on-prem NIOS-X Server)
NIOS-X ServerIP (based on NIOS-X ServerID)	B1DDI	dst	dst	infoblox_ip	IP of the DHCP Server (on-prem NIOS-X Server)
IPSpace (based on subnet uuid or lease uuid)	B1DDI	InfobloxIPSpace	InfobloxIPSpace	dhcp_ip_space	IP Space name
Subnet	B1DDI	InfobloxSubnet	InfobloxSubnet	dhcp_subnet	Subnet in CIDR format
RangeStart	B1DDI	InfobloxRangeStart	InfobloxRangeStart	dhcp_range_start	DHCP range start
RangeEnd	B1DDI	InfobloxRangeEnd	InfobloxRangeEnd	dhcp_range_end	DHCP range end
LeaseOp	B1DDI	InfobloxLeaseOp	InfobloxLeaseOp	action	Update, Delete, Abandon
Address	B1DDI	src	src identSrc	dest dest_ip	IP address
HWAddr	B1DDI	smac	srcMAC	dest_mac	MAC address, colon separated hexadecimal
ClientID	B1DDI	InfobloxClientID	InfobloxClientID	client_id	ClientID, colon separated hexadecimal
DUID	B1DDI	InfobloxDUID	InfobloxDUID	dest_duid	IPv6 DUID. Future releases.
NIOS-X Server name	B1DDI	sNIOS-X Server	identNIOS-X Server name	dest_nt_NIOS-X Server	NIOS-X Server name used by client
Lifetime	B1DDI	InfobloxLifetime	InfobloxLifetime	lease_duration	The lifetime of the lease allocated by server
LeaseUUID	B1DDI	InfobloxLeaseUUID	InfobloxLeaseUUID	dhcp_lease_uuid	Lease UUID
FingerprintProcessed	B1DDI	InfobloxFingerprintPr	InfobloxFingerprintPr	dhcp_fingerprinted	true/false
Fingerprint	B1DDI	InfobloxFingerprint	InfobloxFingerprint	dhcp_fingerprint	DHCP Fingerprint
Options		InfobloxDHCPOptions	InfobloxDHCPOptions	dhcp_options	"Option_Code1=Option_Value1;Option_Code2=Option_Value2;...;Option_CodeN=Option_ValueN"
-	B1DDI			vendor_product	For CIM: Infoblox Universal DDI
	B1DDI			signature	"DHCP lease"