In a DHCP-enabled network, which logs should you examine to determine which system (MAC address) held a specific IP address at a given time?

In a DHCP-enabled network, which logs should you examine to determine which system (MAC address) held a specific IP address at a given time?

• A. On the ARP cache of an individual host
• B. In the Web Server log files
• C. In the DHCP Server log files
• D. There is no way to determine the specific IP address

Answer: (C)

DHCP servers keep a lease database that ties each leased IP to a specific device’s MAC address, along with the time the lease started and ended. To figure out which system held a particular IP at a given moment, you need to inspect the DHCP server logs because they record the assignment events and the exact MAC-IP mapping with timestamps. The ARP cache on a single host is local and often fleeting, so it doesn’t reliably show who had the IP at a past time across the network. Web server logs only show which IPs connected to the server, not the MAC addresses or the historical lease details. Therefore, DHCP server logs provide the authoritative record needed to determine the MAC address associated with an IP at a specific time.

DHCP servers keep a lease database that ties each leased IP to a specific device’s MAC address, along with the time the lease started and ended. To figure out which system held a particular IP at a given moment, you need to inspect the DHCP server logs because they record the assignment events and the exact MAC-IP mapping with timestamps. The ARP cache on a single host is local and often fleeting, so it doesn’t reliably show who had the IP at a past time across the network. Web server logs only show which IPs connected to the server, not the MAC addresses or the historical lease details. Therefore, DHCP server logs provide the authoritative record needed to determine the MAC address associated with an IP at a specific time.