CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?
⚠ Common exam trap
A common mix-up: candidates confuse the Smurf attack with a standard ICMP flood, but the key differentiator is the amplification effect caused by the broadcast address and the spoofed source IP, which results in many replies from varied sources to a single destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP by sending a large number of ICMP Echo Request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All devices on that network then respond with ICMP Echo Reply packets to the victim, overwhelming it. The scenario describes varied source IPs (the responding devices) and a single destination IP (the victim), which is the hallmark of a Smurf attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDP flood
Why it's wrong here
A UDP flood involves an attacker sending a large volume of User Datagram Protocol (UDP) packets, often with spoofed source IP addresses, to random or specific ports on a target system. This attack aims to consume network bandwidth and system resources as the target attempts to process these stateless connections and potentially generate ICMP "Destination Unreachable" responses. However, the observed high volume of ICMP echo replies directly contradicts a UDP flood, which primarily involves UDP traffic and not ICMP echo replies.
- ✗
Ping of Death
Why it's wrong here
The Ping of Death attack exploits a vulnerability in older operating systems by sending an ICMP Echo Request packet that is larger than the maximum allowed IP packet size (65,535 bytes) after reassembly. This oversized, malformed packet would cause a buffer overflow or system crash upon processing, rather than generating a high volume of ICMP echo replies. The core mechanism is a single, specially crafted packet designed to crash a system, not a distributed flood of legitimate-sized responses.
- ✓
Smurf attack
Why this is correct
A Smurf attack is a classic distributed denial-of-service (DDoS) attack that leverages ICMP reflection and amplification. An attacker sends ICMP Echo Request packets with a spoofed source IP address (the victim's IP) to the IP broadcast address of a large network. All active hosts on that network then respond with ICMP Echo Reply packets to the spoofed source IP, overwhelming the victim with a massive flood of replies from numerous legitimate sources. This perfectly matches the observation of a high volume of ICMP echo replies from multiple sources.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood, often referred to as a "ping flood," involves an attacker directly sending a continuous stream of ICMP Echo Request packets to a target system. The objective is to consume the target's bandwidth and processing resources by forcing it to respond to each request, ultimately leading to a denial of service. However, the observed traffic is a high volume of ICMP echo replies, not requests, and typically an ICMP flood originates from a single or limited number of attacker machines, not a distributed response from many sources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.