What information can be obtained from DHCP logs?

What information can be obtained from DHCP logs?

• A. The operating system of the attacker and victim computers
• B. IP traffic between the attacker and the victim
• C. MAC address of the attacker
• D. If any computers on the network are running in promiscuous mode

Answer: (C)

DHCP logs focus on the DHCP transaction and tie it to the client’s hardware address. When a device joins the network, it sends a DHCP Discover that includes its MAC address, and the DHCP server records that MAC along with the IP it offers, the IP it eventually leases, lease duration, and timestamps. Because the MAC is part of each log entry, you can identify which device requested a lease and link activity to that specific device on the network. OS details, actual IP traffic between devices, and NIC states like promiscuous mode aren’t provided by DHCP logs; those require other sources such as OS fingerprints, packet captures, or monitoring tools.

DHCP logs focus on the DHCP transaction and tie it to the client’s hardware address. When a device joins the network, it sends a DHCP Discover that includes its MAC address, and the DHCP server records that MAC along with the IP it offers, the IP it eventually leases, lease duration, and timestamps. Because the MAC is part of each log entry, you can identify which device requested a lease and link activity to that specific device on the network. OS details, actual IP traffic between devices, and NIC states like promiscuous mode aren’t provided by DHCP logs; those require other sources such as OS fingerprints, packet captures, or monitoring tools.