Skip to main content
Lantern Home

 

Splunk Lantern

IP address assignment data

  1. Last updated
  2. Save as PDF

 

IP address assignment data refers to information related to the allocation and configuration of IP (Internet Protocol) addresses to devices, systems, or applications within a network. This data is essential for enabling communication between devices in a network and is used by routers, servers, and client devices to establish connectivity. It helps identify misconfigurations or resolve connectivity issues and is often logged to track which devices use which IPs, aiding in auditing and forensics.

IP addresses are assigned in one of the following ways:

  • Static IP address assignment: The IP address is manually configured and does not change over time.
  • Dynamic IP address assignment (DHCP): An IP address is assigned automatically by a DHCP (dynamic host configuration protocol) server. Dynamic IPs are more flexible for temporary devices (for example, laptops), while static IPs are better for servers or devices that require consistent network locations.
  • Reserved IP assignment (static DHCP or DHCP reservation): A specific IP address is reserved for a device based on its MAC address, even though it is assigned by a DHCP server.
  • APIPA (automatic private IP addressing): APIPA is used when a device cannot obtain an IP address from a DHCP server. It assigns itself a private IP in the range `169.254.x.x`.
  • IPv6 address assignment: IPv6 addresses can be assigned using methods such as SLAAC (Stateless Address Auto-Configuration) or DHCPv6. With the increasing adoption of IPv6, assignment data often includes both IPv4 and IPv6 addresses for compatibility.
  • IP address assignment in cloud environments: Virtual machines (VMs) and resources are assigned public or private IPs by the cloud provider. In cloud environments, dynamic assignment of IPs allows seamless scaling of resources.

IP address assignment data typically includes:

  • The IP address itself
  • The method of assignment (static or dynamic)
  • Subnet masks
  • Gateway addresses
  • DNS server information
  • Lease duration
  • Other configuration details

Before looking at documentation for specific data sources, review the Splunk Docs information on general data ingestion: