CEH Footprinting, Reconnaissance and Scanning Practice Question
An analyst wants to perform a SYN flood attack test against a server to evaluate its resilience. Which of the following tools would be the MOST appropriate for this task?
⚠ Common exam trap
EC-Council often tests the misconception that Nmap's SYN scan (-sS) is equivalent to a SYN flood attack, but Nmap is designed for stealthy reconnaissance with low packet rates, not for overwhelming a target with high-volume traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
hping3
hping3 is the most appropriate tool because it is a command-line packet crafting tool that allows the user to generate custom TCP SYN packets with spoofed source IP addresses, making it ideal for simulating a SYN flood attack. Unlike other tools, hping3 can send a high volume of SYN packets without completing the three-way handshake, which is the core mechanism of a SYN flood that exhausts the server's connection queue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
While Nmap can craft and send custom packets using its --send-eth or --data-string options, its primary design is for network discovery and security auditing, not high-volume, sustained packet generation required for effective SYN flood attacks. It lacks the dedicated performance optimizations and specific SYN flood capabilities found in tools built for DoS simulation, making it inefficient and less suitable for this particular task.
- ✗
Shodan
Why it's wrong here
Shodan functions as a specialized search engine that indexes banners and metadata from internet-connected devices, revealing open ports, services, and vulnerabilities. It is a reconnaissance tool used for discovering potential targets or understanding internet-wide device distribution, but it possesses no functionality whatsoever for initiating or generating any form of network traffic, including SYN packets, for attack simulations.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful network protocol analyzer designed exclusively for capturing, inspecting, and dissecting network traffic in real-time or from saved capture files. Its core function is passive monitoring and analysis, providing deep insights into packet headers and payloads. It fundamentally lacks any capability to construct, inject, or transmit new packets onto a network, making it entirely unsuitable for generating a SYN flood.
- ✓
hping3
Why this is correct
hping3 is a command-line oriented TCP/IP packet assembler/analyzer, specifically engineered for crafting and sending custom packets, including a high volume of SYN packets. Its robust capabilities allow for precise control over packet headers, source IP spoofing, and the ability to flood a target with a continuous stream of SYN requests, making it an ideal and highly effective tool for simulating SYN flood attacks and testing network resilience.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.