ISC DHCP

1 About the Device
2 Device Information
3 Collection Method
4 Port Requirements
5 Device Configuration
6 Integration Parameters

About the Device

The Dynamic Host Configuration Protocol (DHCP) is a network protocol used to assign IP addresses and provide configuration information to devices such as servers, desktops, or mobile devices, so they can communicate on a network using the Internet Protocol (IP). ISC DHCP is a collection of software that implements all aspects of the DHCP (Dynamic Host Configuration Protocol) suite. ISC DHCP solution supports both IPv4 and IPv6, and is suitable for use in high-volume and high-reliability applications.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	ISC
Product Name	DHCP
Type of Device	Hosted

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method
ISC DHCP	ISC_DHCP	Syslog - Structured	CyberHub

Port Requirements

Source	Destination	Port

Source	Destination	Port
ISC DHCP	CyberHub	601 (TCP)

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To direct DHCP logs to a remote server

To check the DHCP logging facility, follow the steps below.
1. Open the dhcpd.conf file (located in the /etc/dhcp directory).
2. Look for the log-facility statement in the file. It will look like: log-facility local6;
3. Note the facility (the string afterlog-facility, for example, local6 in the above case) and close the file.
To edit the rsyslog.conf file:
1. Open the /etc/rsyslog file (or /etc/syslog file in older Linux and Solaris distributions).
2. For ISC DHCP installed on a Linux machine:
  1. Add the following lines at the end of the "### RULES ######" section:
    <logfacility>.*@@<CyberHub_IP_Address>:<601>where logfaciltiy => facility noted in step 1(c) from the above section
  2. Save and close the file.
  3. Restart the rsyslog service by executing following command: service rsyslog restart
3. For ISC DHCP installed on Solaris machine:
  1. Add the following lines at the end of the file:
    <logfacility>.info @@<CyberHub_IP_Address>:<601><logfacility>.err @@<CyberHub_IP_Address>:<601> where Logfaciltiy => facility noted in the step 1(c) from the above section.
  2. Save and close the file.
  3. Restart rsyslog service by executing following command: svcadm restart system-log

Integration Parameters

Parameters required from customer for Integration.

Property	Default Value	Description

Property	Default Value	Description
IP Address	ISC DHCP interface IP address	Hostname or IP address of the device which forwards logs to the CyberHub