IP Address history [duplicate]

Solution 1:

You could try the system event log. Filter for source 'iphlpsvc' and Event Id 4200.

EDIT: Turns out this only works on Server (2008R2), even though the 'IP Helper' service is running on Windows 7 as well, it seems it doesn't write anything to the event log.

I had 5 VMs open and picked the wrong one for the test, sorry.

I couldn't find anything in the service config to turn logging on, but that doesn't mean that's not possible, but you will not get past events.

Solution 2:

When using TCP/IP on an Ethernet network the ARP traffic reveals physical address (MAC) to IP address mappings. This is done with various announcements and queries the results of which are often cached. A router will usually provide an easy way to list this information. In Windows for IP addresses contacted recently (so they are in the ARP cache) you can use ARP -a to list the information. A Windows AD domain controller is an example of such a machine.

Retrieving this information from a machine/router you control and logging it will even let you spot suspicious new MAC addresses should somebody start changing that as well.