CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst runs the following command: 'python macof -i eth0 -n 1000'. Shortly after, the switch begins flooding traffic to all ports. What is the analyst trying to achieve?
⚠ Common exam trap
The CEH exam often tests the distinction between MAC flooding (CAM table overflow) and ARP cache poisoning, so candidates may confuse the two because both involve MAC addresses, but MAC flooding targets the switch's forwarding table while ARP poisoning targets host ARP caches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MAC flooding to force the switch into hub mode for sniffing
The command 'python macof -i eth0 -n 1000' runs the macof tool, which generates a large number of frames with random source MAC addresses. This is a classic MAC flooding attack designed to overflow the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch can no longer learn new MAC addresses and falls back to flooding all incoming frames out of every port, effectively behaving like a hub, which allows the attacker to sniff traffic that would normally be isolated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP starvation to exhaust IP addresses
Why it's wrong here
The 'python macof' command is not used for DHCP starvation. DHCP starvation attacks involve sending a large volume of spoofed DHCP DISCOVER requests to a DHCP server, aiming to exhaust its available IP address pool. Tools like Yersinia or dhcpstarv are specifically designed to interact with the DHCP protocol at the application layer to achieve this, whereas macof operates by flooding MAC addresses at Layer 2.
- ✗
STP manipulation to cause network loops
Why it's wrong here
The 'python macof' command does not perform STP manipulation. Spanning Tree Protocol (STP) manipulation attacks involve sending crafted Bridge Protocol Data Units (BPDUs) to influence the root bridge election or force specific port states, potentially creating network loops or redirecting traffic. Macof's function is limited to generating random MAC addresses and flooding them, which does not involve the generation or interpretation of BPDUs.
- ✓
MAC flooding to force the switch into hub mode for sniffing
Why this is correct
The 'python macof' command correctly executes a MAC flooding attack. This attack rapidly generates and sends frames with unique, spoofed source MAC addresses, overwhelming the switch's Content Addressable Memory (CAM) table. Once the CAM table is full, the switch enters a 'fail-open' mode, behaving like a hub by broadcasting all incoming traffic to every port, thereby enabling an attacker to sniff network traffic.
- ✗
ARP cache poisoning to redirect traffic
Why it's wrong here
The 'python macof' command is not designed for ARP cache poisoning. ARP cache poisoning involves sending spoofed ARP replies to associate an attacker's MAC address with another host's IP address, or vice versa, to redirect traffic through the attacker's machine. Tools such as arpspoof are specifically used for this purpose, as macof only floods MAC addresses and does not manipulate ARP tables or send ARP messages.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.