如果我已经知道客户IP，我知道有/var/log/dnsmasq.log ，它包含日志，如
Jun 13 12:22:42 dnsmasq-dhcp [499]：DHCPACK（wlan0）172.24.1.110 34：12：98：11：80：bd ones-iPad
Jun 13 13:19:44 dnsmasq-dhcp [499]：DHCPDISCOVER（wlan0）d4：97：32：61：4f：73
Jun 13 13:19:44 dnsmasq-dhcp [499]：DHCPOFFER（wlan0）172.24.1.82 d4：97：0b：61：4f：23
Jun 13 13:19:44 dnsmasq-dhcp [499]：DHCPREQUEST（wlan0）172.24.1.82 d4：97：9f：61：4f：73
Jun 13 13:19:44 dnsmasq-dhcp [499]：DHCPACK（wlan0）172.24.1.82 d4：97：0b：23：4f：73 android-ef9f423f7ecaca3c
在路由器中
这样，我们可以每次parsing日志来查看最新的MAC地址。
但是我们能不能每次parsing这个长大的文件都知道客户端的mac是什么。 它拖拽了CPU。
谢谢！
更新
我发现另一个地方包含它
cat /var/lib/misc/dnsmasq.leases
仍然是一个文件。 或者我必须每次parsing文件？
在dnsmasq的man页面中有一个选项说
-l, --dhcp-leasefile=<path> Use the specified file to store DHCP lease information.
所以，你可以使用一个文件来logging它。 该文件的格式是：
946689575 00:00:00:00:00:05 192.168.1.155 wdt 01:00:00:00:00:00:05 946689522 00:00:00:00:00:04 192.168.1.237 * 01:00:00:00:00:00:04 946689351 00:0f:b0:3a:b5:0b 192.168.1.208 colinux * 946689493 02:0f:b0:3a:b5:0b 192.168.1.199 * 01:02:0f:b0:3a:b5:0b
每一行的字段：
1) Time of lease expiry, in epoch time (seconds since 1970). BTW you seem to be living in the past: most of us are well past 1000000000 seconds by now :-) . There are compile time options in dnsmasq which convert this field to be remaining lease time (in seconds) or, in the most recent releases, total lease renewal time. 2) MAC address. 3) IP address. 4) Computer name, if known. This is always unqualified (no domain part) 5) Client-ID, if known. The client-ID is used as the computer's unique-ID in preference to the MAC address, if it's available. Some DHCP clients provide it, and some don't. The ones that do normally derive it from the MAC address unless explicity configured, but it could be something like a serial number, which would protect a computer from losing its identify if the network interface were replaced.
线的顺序没有意义，并会随着时间而改变。