How to decipher Cisco’s user name output in DHCP bindings

Like This Blog 0

Added by Mark Jacob July 14, 2015

If you are using a Cisco router as your DHCP server, you have undoubtedly had occasion to try to figure out which of your clients owned the IP address that was associated with some given MAC address. Here is a cool little side trick which might even be fun enough to use when nothing is broken in your network!

I have constructed a very simple network in GNS3 just so I could configure a router as a DHCP server and issue an address to a client. It is shown in figure 1:

Figure 1

ESW1 is handing out addresses and ESW2 is a client. I changed the mac-address on int f0/0 on ESW2 so I would recognize it immediately. The configured mac-address is dead.beef.cafe.

Figure 2

As you can see, ESW2 has already received an IP address, and it is 172.30.0.52. Now let’s look at the output on ESW1 of the show ip dhcp binding command:

Figure 3

It is clear that we are seeing output in hex. Here is where it gets fun. Copy that hex string and then find yourself a hex-to-ascii converter. I used one that I found here Hex to ASCII text converter. Notice the wealth of information that is discovered after the conversion:

Figure 4

Wow! I see the mac-address of the client – dead.beef.cafe. I can even see the interface involved. You may find this useful when you are trying to track down maleficent mac-addresses in your network.

If you have any comments or questions, please feel free to post them….

Until next time.

Mark Jacob
Cisco and CompTIA Network + Instructor – Interface Technical Training
Phoenix, AZ