diff --git a/CHANGES b/CHANGES
index 045b3e04d3..bb8c7a9a92 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,9 @@
 
+2.4-597 | 2016-06-07 11:46:45 -0700
+
+  * Fixing memory leak triggered by new MAC address logging. (Robin
+    Sommer)
+
 2.4-596 | 2016-06-07 11:07:29 -0700
 
   * Don't create debug.log immediately upon startup (BIT-1616).
diff --git a/VERSION b/VERSION
index de957b70f7..870df27e05 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4-596
+2.4-597
diff --git a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
index a967940ca6..a11412ce96 100644
--- a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
+++ b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
@@ -237,7 +237,7 @@ flow DHCP_Flow(is_orig: bool) {
 
 		Unref(dhcp_msg_val_);
 
-		const char* mac_str = fmt_mac(${msg.chaddr}.data(), ${msg.chaddr}.length());
+		std::string mac_str = fmt_mac(${msg.chaddr}.data(), ${msg.chaddr}.length());
 
 		RecordVal* r = new RecordVal(dhcp_msg);
 		r->Assign(0, new Val(${msg.op}, TYPE_COUNT));
@@ -247,8 +247,6 @@ flow DHCP_Flow(is_orig: bool) {
 		r->Assign(4, new AddrVal(${msg.ciaddr}));
 		r->Assign(5, new AddrVal(${msg.yiaddr}));
 
-		delete [] mac_str;
-
 		dhcp_msg_val_ = r;
 
 		switch ( ${msg.op} )
diff --git a/src/net_util.cc b/src/net_util.cc
index 375f926394..677a869cc5 100644
--- a/src/net_util.cc
+++ b/src/net_util.cc
@@ -148,9 +148,9 @@ const char* fmt_conn_id(const uint32* src_addr, uint32 src_port,
 	return fmt_conn_id(src, src_port, dst, dst_port);
 	}
 
-char* fmt_mac(const unsigned char* m, int len)
+std::string fmt_mac(const unsigned char* m, int len)
 	{
-	char* buf = new char[25];
+	static char buf[25];
 
 	if ( len < 8 && len != 6 )
 		{
@@ -159,10 +159,10 @@ char* fmt_mac(const unsigned char* m, int len)
 		}
 
 	if ( (len == 6) || (m[6] == 0 && m[7] == 0) ) // EUI-48
-		snprintf(buf, 19, "%02x:%02x:%02x:%02x:%02x:%02x",
+		snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
 			 m[0], m[1], m[2], m[3], m[4], m[5]);
 	else
-		snprintf(buf, 25, "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
+		snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
 			 m[0], m[1], m[2], m[3], m[4], m[5], m[6], m[7]);
 
 	return buf;
diff --git a/src/net_util.h b/src/net_util.h
index ebdd0cbb88..52ee53f1dd 100644
--- a/src/net_util.h
+++ b/src/net_util.h
@@ -166,7 +166,7 @@ extern const char* fmt_conn_id(const uint32* src_addr, uint32 src_port,
 *            least 8 for a valid address.
 * @return A string of the formatted MAC. Passes ownership to caller.
 */
-extern char* fmt_mac(const unsigned char* m, int len);
+extern std::string fmt_mac(const unsigned char* m, int len);
 
 // Read 4 bytes from data and return in network order.
 extern uint32 extract_uint32(const u_char* data);