UTM says I keep exceeding my licensed users, but I'm not

Hi Charles and welcome to the UTM Community!

The UTM counts IPs that it has "seen" in the last 7 days.  It "sees" an IP if you ping it even if it's not there.

Cheers - Bob

Thanks for the reply Bob. Two obvious questions.

1) How do I reset the 7 day counter?

2) I have never had over 50 devices. I've run UTM for years, but this just started a week or so ago. What created this problem?

Not much of a jump, but this morning I'm up to 76 devices. Is there maybe a bug in the DHCP lease module?

You used to be able to restart the UTM I believe to get it to clear out old lease information.  I'm not sure that is really the case anymore.  An older trick was to disable DHCP, shrink your range, enable, disable, expand it back and it would clear out leases.  You could also try deleting the DHCP range altogether and recreate it.

There is a way to SSH in and modify, but I don't know that one.  I bet Bob does though.  ;)

Sophos "fixed" the trick that let one reset the count.  If there's a way to do it today, I'd be surprised.

No DHCP bug that might cause this has been reported here.  Do you see a lot of active leases on the 'IPv4 Lease Table' tab?  Do you see a lot of IP assignments in the DHCP server logs?  To see all IPs in the log in March:

 # zgrep 'DHCPACK' /var/log/dhcpd/2021/03/*|grep -oP 'DHCPACK to .*? \('|sort -n|uniq -c

It's more likely some device that's scanning a range of IPs.

Cheers - Bob

Sophos "fixed" the trick that let one reset the count.  If there's a way to do it today, I'd be surprised.

No DHCP bug that might cause this has been reported here.  Do you see a lot of active leases on the 'IPv4 Lease Table' tab?  Do you see a lot of IP assignments in the DHCP server logs?  To see all IPs in the log in March:

 # zgrep 'DHCPACK' /var/log/dhcpd/2021/03/*|grep -oP 'DHCPACK to .*? \('|sort -n|uniq -c

It's more likely some device that's scanning a range of IPs.

Cheers - Bob