CEH Practice Question: Malware, Social Engineering and Network Attacks
A penetration tester uses a tool to spoof ARP replies, redirecting traffic through the tester's machine. The tester then captures credentials from the redirected traffic. Which tool is BEST suited for this task?
⚠ Common exam trap
Many candidates confuse passive sniffing tools like Wireshark or tcpdump with active MITM tools, assuming any packet capture tool can also perform ARP spoofing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is the best tool for ARP spoofing because it is specifically designed for man-in-the-middle (MITM) attacks on local networks. It actively sends forged ARP replies to poison the ARP cache of target hosts, redirecting traffic through the attacker's machine, and includes built-in packet capture and credential extraction features.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ettercap
Why this is correct
Ettercap is a comprehensive suite specifically designed for man-in-the-middle (MITM) attacks, making it the correct tool for ARP poisoning. It actively injects forged ARP replies into a local area network, associating the attacker's MAC address with the IP address of a legitimate host, such as the default gateway. This redirection allows Ettercap to intercept, modify, and forward traffic between the target and the intended destination, enabling sniffing and various active attacks.
- ✗
Wireshark
Why it's wrong here
Wireshark functions as a powerful network protocol analyzer, primarily used for capturing and interactively examining network traffic. While it can display ARP packets and help diagnose ARP-related issues, it is a passive monitoring tool that lacks the capability to actively generate or spoof ARP replies. Its purpose is observation and analysis of network communications, not active network manipulation or attack execution.
- ✗
Nmap
Why it's wrong here
Nmap, or Network Mapper, is an open-source utility primarily utilized for network discovery and security auditing. Its core functionalities include host discovery, port scanning, operating system detection, and service version detection across networks. Nmap is designed for reconnaissance and enumeration of network assets and vulnerabilities, not for actively performing man-in-the-middle attacks or manipulating network protocols like ARP to redirect traffic.
- ✗
tcpdump
Why it's wrong here
tcpdump is a command-line packet sniffer that allows users to capture and analyze network traffic flowing through a system interface. It provides detailed insights into network packets, including ARP requests and replies, but it is strictly a passive monitoring tool. tcpdump cannot actively generate or inject spoofed ARP packets onto the network to facilitate traffic redirection or man-in-the-middle attacks, as its functionality is limited to observation.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.