In a vulnerable ARP poisoning lab, which IP address is used to help determine poisoning?

In a vulnerable ARP poisoning lab, which IP address is used to help determine poisoning?

• A. 192.168.0.6
• B. 10.0.0.1
• C. 172.16.0.5
• D. 192.168.0.2

Answer: (D)

ARP poisoning is detected by watching how IPs are mapped to MAC addresses on the network. The trusted way to confirm poisoning is to monitor the ARP entry for a known host on the local network and see if its MAC address suddenly changes to the attacker’s MAC. In this lab setup, the address 192.168.0.2 represents the target device whose ARP mapping you inspect. If poisoning is active, the ARP table will show the MAC for that IP as the attacker’s MAC instead of the legitimate one, signaling that traffic destined for that host is being redirected. The other addresses are either on different subnets or are not the specific host whose ARP mapping you’re using to verify poisoning in this scenario, so they won’t reliably reveal the poisoning in the same way.

ARP poisoning is detected by watching how IPs are mapped to MAC addresses on the network. The trusted way to confirm poisoning is to monitor the ARP entry for a known host on the local network and see if its MAC address suddenly changes to the attacker’s MAC. In this lab setup, the address 192.168.0.2 represents the target device whose ARP mapping you inspect. If poisoning is active, the ARP table will show the MAC for that IP as the attacker’s MAC instead of the legitimate one, signaling that traffic destined for that host is being redirected.

The other addresses are either on different subnets or are not the specific host whose ARP mapping you’re using to verify poisoning in this scenario, so they won’t reliably reveal the poisoning in the same way.