DHCP Settings

Overview

Evidence: DHCP Settings
Description: Collect DHCP (Dynamic Host Configuration Protocol) Settings
Category: Network
Platform: macos
Short Name: dhcpset
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

DHCP client leases record IP configuration and router details per interface. This data is essential for reconstructing network assignments and connectivity history.

Data Collected

This collector gathers structured data about dhcp settings.

Collection Method

This collector parses plist leases under /private/var/db/dhcpclient/leases and records them into dhcp_settings.

Forensic Value

This evidence is crucial for forensic investigations as it links devices to networks and IP addresses over time.