DHCP collection tab

The sensor can receive and process DHCP records produced by an external generator, typically the logs from a Windows server. The sensor runs a collector daemon that listens on a specific TCP port for incoming data, which is then parsed, filtered, and uploaded.

The VMware NSX Network Detection and Response DHCP Integration Guide ( HTML) describes the process for forwarding DHCP logs to the system for ingestion and processing.

To configure this tab, you must first select a Sensor. Click the Appliance button then select the appropriate appliance from the Select appliances pop-up. Click Select appliance to dismiss the pop-up.

Click the button to create a new entry.

The DHCP collectors list includes the following fields:

Name

A name uniquely identifying the data generator. This field is required. A string of lowercase characters is expected.

Generator IP(s)

The IP address of the generator as seen by the collector (to enable firewall filtering). This field is optional. If set, the collector will only accept records from sources at the specified IP address(es). Any records from other IP addresses are discarded. If left unset, the collector will accept records sent from any IP address.

Port number

The port on the sensor where the DHCP log data will be received. This field is required. It accepts values from 1024 to 65535.

Actions

To delete a collector, click the icon.

When you are done, click Save. This triggers a reconfiguration on the sensor, after which a DHCP ingestion process is ready to receive DHCP logs on the specified port number. The progress of the reconfiguration action can be followed on the Monitoring logs tab.