CEH Practice Question: Malware, Social Engineering and Network Attacks
A security team detects that an internal host is sending ARP replies claiming to have the IP address of the default gateway. Which tool is MOST likely being used to perform this attack?
⚠ Common exam trap
Candidates often confuse passive monitoring tools (tcpdump, Wireshark) with active attack tools, or mistake Nmap's scanning capabilities for ARP spoofing, when only Ettercap is specifically designed for MITM via ARP poisoning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is a dedicated man-in-the-middle (MITM) attack tool that includes built-in ARP poisoning functionality. It sends forged ARP replies to associate the attacker's MAC address with the default gateway's IP, redirecting traffic through the attacker's host. This matches the described behavior of claiming the gateway's IP address via ARP replies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is primarily a network discovery and security auditing tool. It excels at host discovery, port scanning, OS detection, and service version detection by sending various types of packets and analyzing responses. While it can interact with network protocols at a low level, its core functionality does not include injecting malicious ARP replies or performing man-in-the-middle attacks, which are characteristic of ARP spoofing tools.
- ✗
tcpdump
Why it's wrong here
tcpdump is a command-line packet analyzer that captures and displays network traffic. It operates passively, listening to network interfaces and filtering packets based on user-defined rules, providing detailed information about the captured data. However, tcpdump is strictly a monitoring tool; it lacks the capability to actively generate or inject arbitrary packets, such as forged ARP replies, into the network to manipulate traffic flow.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful graphical user interface (GUI) network protocol analyzer widely used for troubleshooting, analysis, and development. It captures network traffic and presents it in a human-readable format, allowing deep inspection of individual packets and protocol dissections. While invaluable for detecting ARP spoofing by observing anomalous ARP traffic, Wireshark itself is a passive analysis tool and does not possess the functionality to actively perform or initiate network attacks like ARP poisoning.
- ✓
Ettercap
Why this is correct
Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs, specifically designed for ARP poisoning. It actively injects forged ARP replies into the network, tricking hosts into believing the attacker's MAC address is associated with the gateway's IP, and vice-versa. This redirection allows Ettercap to intercept, analyze, and even modify traffic between victims, making it a primary tool for detecting and executing ARP-based attacks.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.