An IP management (IPAM) tool scans a network to identify which IP addresses are in use. This list is then reconciled with the list of addresses that the associated DHCP server has allocated. If the IPAM detects an IP address that wasn’t allocated by the DHCP server, it has discovered an unauthorized device connected to the network. If an address that the DHCP server records as being in use isn’t found to be active on the network, that IP address has been abandoned and the DHCP server returns it to the pool of IP addresses that are available for allocation.