CEH Footprinting, Reconnaissance and Scanning Practice Question

A security team wants to identify all live hosts on a large, Class B private IP network (172.16.0.0/16) as quickly as possible while minimizing network load. Which tool and technique should they use?

⚠ Common exam trap

It's easy for candidates to assume Nmap's -sn is the fastest option because it is the most commonly used ping sweep tool, but they overlook Masscan's specialized design for ultra-high-speed scanning across large ranges, which is explicitly tested in CEH questions about minimizing time and network load.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Masscan with --ping to send ICMP echo requests across the /16 range

Masscan is designed for high-speed scanning and can send ICMP echo requests across a /16 range (65,536 IPs) in seconds, far faster than Nmap or hping3, while its --ping mode minimizes network load by using stateless packet transmission. This makes it the optimal choice for quickly identifying live hosts on a large private network without overwhelming the network.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Masscan with --ping to send ICMP echo requests across the /16 range
Why this is correct
Masscan is specifically engineered for high-speed network scanning, capable of transmitting millions of packets per second. Utilizing the `--ping` option directs Masscan to send ICMP echo request packets across the entire /16 range, efficiently identifying live hosts. Its asynchronous design allows it to discover active devices across 65,536 IP addresses in a fraction of the time compared to traditional scanners, making it the optimal tool for rapid, large-scale host discovery.
✗
Use theHarvester to query DNS records for the domain
Why it's wrong here
theHarvester is an open-source intelligence (OSINT) tool designed for passive information gathering from public sources like search engines, PGP key servers, and social media. Its primary function is to collect email addresses, subdomains, hostnames, and employee names associated with a target domain. It does not perform active network scanning or send ICMP requests to identify live hosts on a private network segment, rendering it unsuitable for this specific task of active host discovery.
✗
Nmap with -sn (ping sweep) on all 65536 IPs
Why it's wrong here
While Nmap can perform ping sweeps using the `-sn` (or `-PE`) option to identify live hosts, its default scanning methodology is comparatively slower than specialized tools like Masscan for extremely large ranges. For a /16 network containing 65,536 IP addresses, Nmap's sequential or less aggressive parallel scanning approach would require a significantly longer duration to complete the sweep. This makes it less efficient for rapid initial host discovery on such an expansive subnet when speed is a critical factor.
✗
hping3 with --icmp on each IP sequentially
Why it's wrong here
hping3 is a command-line packet crafter and analyzer, primarily used for manual packet manipulation, firewall testing, and network troubleshooting on a per-host or small-scale basis. Its design is not optimized for high-speed, large-scale network sweeps across thousands of IP addresses. Attempting to sequentially send ICMP packets to each of the 65,536 IPs in a /16 range with hping3 would be an extremely time-consuming and inefficient process, making it impractical for rapid host discovery.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question