---
title: "DHCP Message Mapping"
canonical: "https://docs.infoblox.com/space/BloxOneCloud/35366624/DHCP%20Message%20Mapping"
format: markdown
---
<span style="color: #000000">This topic contains information about supported fields in DHCP log messages for Universal DDI. It also contains corresponding field elements in CEF and LEEF formats via the syslog protocol and Splunk CIM via Splunk forwarder.</span>

> ⚠️ **Note**
> ⚠️ 
> ⚠️ NIOS DHCP  is not supported at the current time.

<span style="color: #000000">CEF and LEEF messages use standard headers, as described below. </span>

## <span style="color: #000000">CEF Message header</span>

|  |
| --- |
| <span style="color: #000000">CEF:0|Infoblox|Data Connector|1.0.0|DHCP-LEASE-</span><span style="color: #000000">**$LeaseOp**</span><span style="color: #000000">|DHCP Lease </span><span style="color: #000000">**$LeaseOp**</span><span style="color: #000000">|1</span> |

<span style="color: #000000">You can find LeaseOp values in the table below. </span>

## <span style="color: #000000">LEEF Message header</span>

|  |
| --- |
| <span style="color: #000000">LEEF:1.0|Infoblox|Data Connector|1.0.0|DHCP-LEASE-</span><span style="color: #000000">**$LeaseOp**</span> |

> ⚠️ DHCP lease data is now transmitted using compact byte-string formats instead of human-readable strings to improve efficiency (for example, MAC addresses are sent as 6 bytes rather than 17-character strings). Deprecated V0 string fields may still appear for backward compatibility. Any unusual characters in logs are due to raw byte values being rendered as printable characters or Unicode escape sequences. Logs reflect the full lease data structure as sent, including internal fields.

<span style="color: #000000">You can find LeaseOp values in the table below. </span>

<span style="color: #000000">The following table contains supported fields in DHCP logs for Universal DDI and their corresponding field elements for other supported message formats. </span>

| **Internal field** | **Product** | **CEF** | **LEEF** | **Splunk CIM** | **Description** |
| --- | --- | --- | --- | --- | --- |
| Cltt | B1DDI | timestamp* | timestamp* | timestamp* | Date/Time |
|  | B1DDI | cat | cat |  | DHCP Lease **$LeaseOp** |
|  | B1DDI | app | app |  | DHCP |
| Host (based on HostID) | B1DDI | InfobloxHost | InfobloxHost | infoblox_host | Hostname of the DHCP server (host) |
| HostIP (based on HostID) | B1DDI | dst | dst | infoblox_ip | IP of the DHCP Server (host) |
| IPSpace (based on subnet uuid or lease uuid) | B1DDI | InfobloxIPSpace | InfobloxIPSpace | dhcp_ip_space | IP Space name |
| Subnet | B1DDI | InfobloxSubnet | InfobloxSubnet | dhcp_subnet | Subnet in CIDR format |
| RangeStart | B1DDI | InfobloxRangeStart | InfobloxRangeStart | dhcp_range_start | DHCP range start |
| RangeEnd | B1DDI | InfobloxRangeEnd | InfobloxRangeEnd | dhcp_range_end | DHCP range end |
| LeaseOp | B1DDI | InfobloxLeaseOp | InfobloxLeaseOp | action | Create, Update, Delete, Abandon |
| Address | B1DDI | src | src<br>identSrc | dest<br>dest_ip | IP address |
| HWAddr | B1DDI | smac | srcMAC | dest_mac | MAC address, colon separated hexadecimal |
| ClientID | B1DDI | InfobloxClientID | InfobloxClientID | client_id | ClientID, colon separated hexadecimal |
| DUID | B1DDI | InfobloxDUID | InfobloxDUID | dest_duid | IPv6 DUID. Future releases. |
| Hostname | B1DDI | shost | identHostName | dest_nt_host | Hostname used by client |
| Lifetime | B1DDI | InfobloxLifetime | InfobloxLifetime | lease_duration | The lifetime of the lease allocated by server |
| LeaseUUID | B1DDI | InfobloxLeaseUUID | InfobloxLeaseUUID | dhcp_lease_uuid | Lease UUID |
| FingerprintProcessed | B1DDI | InfobloxFingerprintPr | InfobloxFingerprintPr | dhcp_fingerprinted | true/false |
| Fingerprint | B1DDI | InfobloxFingerprint | InfobloxFingerprint | dhcp_fingerprint | DHCP Fingerprint |
| Options |  | InfobloxDHCPOptions | InfobloxDHCPOptions | dhcp_options | "Option_Code1=Option_Value1;Option_Code2=Option_Value2;...;Option_CodeN=Option_ValueN" |
| - | B1DDI |  |  | vendor_product | For CIM:<br>Universal DDI |
|  | B1DDI |  |  | signature | "DHCP lease" |

<span style="color: #000000">This topic contains information about supported fields in DHCP log messages for Universal DDI. It also contains corresponding field elements in CEF and LEEF formats via the syslog protocol and Splunk CIM via Splunk forwarder.</span>

> ⚠️ **Note**
> ⚠️ 
> ⚠️ NIOS DHCP  is not supported at the current time.

<span style="color: #000000">CEF and LEEF messages use standard headers, as described below. </span>

## <span style="color: #000000">CEF Message header</span>

|  |
| --- |
| <span style="color: #000000">CEF:0|Infoblox|Data Connector|1.0.0|DHCP-LEASE-</span><span style="color: #000000">**$LeaseOp**</span><span style="color: #000000">|DHCP Lease </span><span style="color: #000000">**$LeaseOp**</span><span style="color: #000000">|1</span> |

<span style="color: #000000">You can find LeaseOp values in the table below. </span>

## <span style="color: #000000">LEEF Message header</span>

|  |
| --- |
| <span style="color: #000000">LEEF:1.0|Infoblox|Data Connector|1.0.0|DHCP-LEASE-</span><span style="color: #000000">**$LeaseOp**</span> |

<span style="color: #000000">You can find LeaseOp values in the table below. </span>

<span style="color: #000000">The following table contains supported fields in DHCP logs for Universal DDI and their corresponding field elements for other supported message formats. </span>

| **Internal field** | **Product** | **CEF** | **LEEF** | **Splunk CIM** | **Description** |
| --- | --- | --- | --- | --- | --- |
| Cltt | B1DDI | timestamp* | timestamp* | timestamp* | Date/Time |
|  | B1DDI | cat | cat |  | DHCP Lease **$LeaseOp** |
|  | B1DDI | app | app |  | DHCP |
| Host (based on HostID) | B1DDI | InfobloxHost | InfobloxHost | infoblox_host | Hostname of the DHCP server (host) |
| HostIP (based on HostID) | B1DDI | dst | dst | infoblox_ip | IP of the DHCP Server (host) |
| IPSpace (based on subnet uuid or lease uuid) | B1DDI | InfobloxIPSpace | InfobloxIPSpace | dhcp_ip_space | IP Space name |
| Subnet | B1DDI | InfobloxSubnet | InfobloxSubnet | dhcp_subnet | Subnet in CIDR format |
| RangeStart | B1DDI | InfobloxRangeStart | InfobloxRangeStart | dhcp_range_start | DHCP range start |
| RangeEnd | B1DDI | InfobloxRangeEnd | InfobloxRangeEnd | dhcp_range_end | DHCP range end |
| LeaseOp | B1DDI | InfobloxLeaseOp | InfobloxLeaseOp | action | Create, Update, Delete, Abandon |
| Address | B1DDI | src | src<br>identSrc | dest<br>dest_ip | IP address |
| HWAddr | B1DDI | smac | srcMAC | dest_mac | MAC address, colon separated hexadecimal |
| ClientID | B1DDI | InfobloxClientID | InfobloxClientID | client_id | ClientID, colon separated hexadecimal |
| DUID | B1DDI | InfobloxDUID | InfobloxDUID | dest_duid | IPv6 DUID. Future releases. |
| Hostname | B1DDI | shost | identHostName | dest_nt_host | Hostname used by client |
| Lifetime | B1DDI | InfobloxLifetime | InfobloxLifetime | lease_duration | The lifetime of the lease allocated by server |
| LeaseUUID | B1DDI | InfobloxLeaseUUID | InfobloxLeaseUUID | dhcp_lease_uuid | Lease UUID |
| FingerprintProcessed | B1DDI | InfobloxFingerprintPr | InfobloxFingerprintPr | dhcp_fingerprinted | true/false |
| Fingerprint | B1DDI | InfobloxFingerprint | InfobloxFingerprint | dhcp_fingerprint | DHCP Fingerprint |
| Options |  | InfobloxDHCPOptions | InfobloxDHCPOptions | dhcp_options | "Option_Code1=Option_Value1;Option_Code2=Option_Value2;...;Option_CodeN=Option_ValueN" |
| - | B1DDI |  |  | vendor_product | For CIM:<br>Universal DDI |
|  | B1DDI |  |  | signature | "DHCP lease" |

# DHCP Message Mapping for Splunk CIM

Aligns Infoblox DHCP lease operation values to the Splunk CIM Network Session **action** field, while preserving the original Infoblox lease semantics.

- Splunk CIM prescribes the action field values **“started”**, **“ended”**, and **“blocked”**, which are used to represent DHCP lease starts, ends, and failed or abandoned leases, respectively. The value **“updated”** is not defined in the CIM Network Sessions model, so update events are mapped to **“started.”**
- To preserve the original semantics, we will continue to include the native lease operation in a dedicated field (for example, `infoblox_lease_op=Create/Update/Delete/Abandon`) while reflecting the CIM-aligned value in the action field as described above. This approach ensures CIM-compliant dashboards use the standard action values, while still allowing searches and dashboards to distinguish renewals and other changes using the native lease operation.
- For more information on using Splunk networking session events, see the *[Splunk documentation](https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.1/data-models/network-sessions)*.

| **Infoblox DHCP** | **Spunk CIM** |
| --- | --- |
| Create | Started |
| Update | Started |
| Delete | Ended |
| Abandon | Blocked |

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
| **Data name** | **Field name** | **Data type** | **Description** | **Abbreviated list of example values** |
| All_Sessions | action | string | The action taken by the reporting device. | Required for pytest-splunk-addon Prescribed values are:<br>- started (for VPN session starts,and DNCP lease starts)
- ended (for VPN session teardowns and DHCP lease ends)
- blocked (for VPN session disallowed start attempts or failed DHCP leases) |