When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

Question

Options

• AOn the individual computer ARP cache
• BIn the Web Server log files
• CIn the DHCP Server log files
• DThere is no way to determine the specific IP address

• A
  6% (1)
• C
  89% (16)
• D
  6% (1)

Explanation

DHCP (Dynamic Host Configuration Protocol) servers maintain detailed lease logs that record each IP address assignment, including the MAC address of the client device, the assigned IP address, the lease start time, and the lease duration. By reviewing these DHCP server logs, a forensic investigator can definitively correlate a specific IP address to a specific device (identified by MAC address) at a specific point in time. ARP caches on individual computers only hold short-lived, in-memory mappings and are not reliable for historical lookups. Web server logs track HTTP requests, not IP-to-MAC mappings. DHCP logs are the authoritative and standard source for this type of investigation.

No community discussion yet for this question.