ARP Poisoning Detection: Multiple MAC Addresses per IP
A security analyst notices that the ARP cache on a workstation contains multiple entries for the same IP address with different MAC addresses. Which attack is likely occurring?
Quick Answer
The answer is ARP poisoning. This is correct because ARP poisoning, also known as ARP spoofing, occurs when an attacker sends forged ARP replies to a target network, causing the victim’s ARP cache to map a single IP address to multiple MAC addresses. In a legitimate network, each IP should correspond to exactly one MAC; multiple entries for the same IP indicate that an attacker is intercepting traffic by associating their own MAC with the victim’s IP. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of network-based attacks at Layer 2, often appearing in questions about man-in-the-middle attacks or session hijacking. A common trap is confusing this with MAC flooding, which overwhelms a switch’s CAM table rather than corrupting a host’s ARP cache. For a quick memory tip: think “one IP, many MACs equals ARP attack.”
⚠ Common exam trap
It's easy for candidates to confuse ARP poisoning with MAC flooding; candidates often pick MAC flooding because both involve MAC addresses, but MAC flooding targets switch CAM tables, not workstation ARP caches, and does not produce multiple MAC entries for the same IP on a single host. CEH exam questions often test this distinction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning
ARP poisoning (also called ARP spoofing) occurs when an attacker sends forged ARP replies to a network, associating their own MAC address with the IP address of a legitimate host (e.g., the default gateway). The workstation's ARP cache then stores multiple MAC addresses for the same IP, as the cache is updated with each fraudulent reply. This allows the attacker to intercept, modify, or block traffic intended for that IP, enabling man-in-the-middle attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP poisoning
Why this is correct
ARP poisoning causes multiple MAC entries for one IP due to forged ARP replies.
- ✗
Session hijacking
Why it's wrong here
Session hijacking steals session tokens, not directly shown in ARP cache.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing affects DNS cache, not ARP cache.
- ✗
MAC flooding
Why it's wrong here
MAC flooding fills CAM table with many MACs, not the same IP with multiple MACs.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, a security analyst captures network traffic and observes a series of ARP replies without corresponding ARP requests. An internal host's IP address is suddenly associated with two different MAC addresses. Which attack is MOST likely occurring?
medium- A.Session hijacking
- B.MAC flooding
- C.DNS spoofing
- ✓ D.ARP poisoning
Why D: D is correct because ARP poisoning (also known as ARP spoofing) involves sending forged ARP replies to associate a target IP address with an attacker's MAC address, allowing man-in-the-middle attacks. The observation of unsolicited ARP replies (gratuitous ARPs) that map one IP to two different MAC addresses is the classic signature of an ongoing ARP poisoning attack.
Variation 2. A security analyst captures network traffic and sees a sequence of ARP replies with the same IP address mapping to different MAC addresses within a short period. Which attack is indicated?
hard- A.DNS spoofing
- ✓ B.ARP poisoning
- C.DHCP starvation
- D.MAC flooding
Why B: B is correct because ARP poisoning (also called ARP spoofing) involves sending forged ARP replies that map a target IP address (e.g., the default gateway) to the attacker's MAC address. The rapid sequence of ARP replies with the same IP but different MACs is a classic indicator of an active ARP poisoning attack, where the attacker floods the network to corrupt the ARP cache of hosts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.