Hi team,

In "IP/mac address search", we can get the full mapping of IP address, MAC address and switch port.
However, connection history log only stores IP and switch port, without the corresponding MAC address at that time.

Could you please improve this feature? We hope real-time search and history records can be consistent, storing and displaying complete client information for network forensics.

Thanks a lot!

Hi,

MAC address is stored - it's the MAC Address column on your second screenshot. What is empty there is IP address.

Connection history is built from switch forwarding tables, so it always knows MAC, and takes IP from the node this MAC belongs to. 10.61.67.118 is not a node in NetXMS (Node and Interface columns are empty in the search result), so there is nothing to take it from. IP address search finds the pair differently, by reading ARP caches.

Resolving IP from ARP for hosts which are not nodes is not implemented, I've created feature request: https://github.com/netxms/netxms/issues/3760

If these hosts are added as nodes, new history records will probably have both IP and node filled.

Thank you very much for your quick reply. Our use case is: based on historical IP addresses (for example, IPs logged when users access critical systems), we want to look up the MAC address associated with that IP at that point in time, so we can identify the specific endpoint. We look forward to this new feature. Many thanks!