dgnorton: how long are the DHCP assignments?

Are there too many hosts or are the leases to short to do address/mac resolution (each DHCP period...) and have a simple lookup to log all data for IP? [swap IP for mac when you store].

How accurate do u want these statistics? ballpark or on the dot?

I don't know what backend you could have on tcpdump...

If you can integrate with your DHCP/DNS you may be able to get around it.

Thinking out loud...