Hail to the community!
I am experiencing DHCP Pool Exhaustion due to an angry pool scanner, maybe is a Wi-Fi mobile roaming or a ghost wandering, who knows.

Question is that I am trying to creat an alert that detects this behaviour on the fly, but any of the selects goes throught a database parsing, for each "DHCP Client Name" count and present any that is beyond 3 ip addresses, that is to avoid false positive for clusters.
Is there any feature that is already parsinge this? or if not Do you know a code to check this and do not crash the service?
Thansk in advance!