CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst is asked to perform a fast scan of a large network (e.g., /16 subnet) to identify live hosts. Which tool is MOST suitable for this task due to its high speed?
⚠ Common exam trap
It's easy for candidates to assume Nmap is always the fastest scanning tool due to its popularity, but Masscan is specifically engineered for speed on massive networks, and the CEH exam tests this distinction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Masscan
Masscan is the most suitable tool for this task because it is designed specifically for high-speed scanning of large address spaces, such as a /16 subnet (65,536 hosts). It uses asynchronous transmission and can send packets at rates exceeding 10 million packets per second, making it significantly faster than Nmap for raw host discovery across massive ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
hping3
Why it's wrong here
hping3 is primarily a command-line packet crafting tool used for sending custom TCP/IP packets and analyzing responses. While it can be used for basic host discovery or port testing on a single target, its design is not optimized for rapid, wide-scale network scanning across large IP ranges. It excels at detailed, low-level network testing and firewall rule verification, rather than broad enumeration.
- ✗
Nmap
Why it's wrong here
Nmap is a highly versatile and powerful network scanner capable of detailed port scanning, service version detection, OS fingerprinting, and vulnerability detection through its scripting engine. However, its comprehensive approach, including default timing parameters and script execution, makes it inherently slower than tools specifically designed for raw speed when scanning extremely large networks. While excellent for in-depth analysis of specific targets or smaller subnets, it prioritizes detail over the sheer speed required for internet-scale discovery.
- ✓
Masscan
Why this is correct
Masscan is purpose-built for extremely high-speed network scanning, capable of scanning the entire internet in minutes by operating asynchronously and sending raw packets. Unlike traditional scanners, it does not maintain a full TCP connection state, allowing it to saturate network links with SYN packets and quickly identify open ports across vast IP address ranges. This stateless, raw packet approach makes it the optimal choice for rapid, large-scale port discovery when speed is the paramount requirement.
- ✗
Wireshark
Why it's wrong here
Wireshark is a widely used graphical network protocol analyzer that passively captures and inspects network traffic in real-time or from saved capture files. Its primary function is to analyze existing data flows, decode protocols, and troubleshoot network issues, rather than actively probing hosts or discovering open ports. As a passive listening tool, it does not send out scanning probes and therefore cannot perform active network reconnaissance like port scanning.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.