CEH Practice Question: Malware, Social Engineering and Network Attacks
During a penetration test, a security analyst runs the following command on a Linux system: ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//. What is the PRIMARY purpose of this command?
⚠ Common exam trap
A common mix-up: candidates confuse ARP poisoning with DNS spoofing or assume the command is for passive sniffing, but the `-M arp:remote` flag explicitly indicates an active MITM attack, not a passive or flooding technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To perform a man-in-the-middle attack between the gateway and the target host
The command `ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//` uses ARP poisoning in remote mode to intercept traffic between the gateway (192.168.1.1) and the target host (192.168.1.100). By sending forged ARP replies to both devices, the attacker's machine becomes a man-in-the-middle, allowing it to capture, modify, or relay packets between them. The `-M arp:remote` flag specifically enables ARP poisoning for a MITM attack, not for DNS spoofing, promiscuous mode, or flooding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To spoof the DNS responses to redirect the target to a malicious site
Why it's wrong here
While `ettercap -M arp:remote` establishes the necessary man-in-the-middle position through ARP poisoning, it does not inherently perform DNS spoofing. To achieve DNS redirection, additional Ettercap filters or a separate DNS spoofing tool would need to be configured and activated. This command solely focuses on manipulating ARP tables to intercept traffic, not altering DNS responses directly.
- ✗
To sniff all traffic on the network by enabling promiscuous mode on the interface
Why it's wrong here
Enabling promiscuous mode allows an interface to capture all traffic passing through the network segment, regardless of the destination MAC address. However, `ettercap -M arp:remote` goes beyond passive sniffing by actively performing ARP poisoning. This active manipulation redirects traffic intended for other hosts or the gateway directly to the attacker, enabling a true man-in-the-middle attack rather than just observing broadcast traffic.
- ✗
To perform a denial-of-service attack by flooding the network with ARP replies
Why it's wrong here
The `ettercap -M arp:remote` command's primary function is to redirect network traffic by poisoning ARP caches, not to cause a denial-of-service (DoS) attack. While excessive ARP replies *could* theoretically overwhelm some older or poorly configured devices, Ettercap's ARP poisoning is designed for stealthy traffic interception, not network disruption. Its goal is to facilitate a man-in-the-middle scenario, allowing the attacker to inspect or modify data, rather than to flood the network into unavailability.
- ✓
To perform a man-in-the-middle attack between the gateway and the target host
Why this is correct
The `ettercap -M arp:remote` command is specifically designed to execute a man-in-the-middle (MITM) attack by poisoning the ARP caches of both the target host and the network gateway. By sending forged ARP replies, the attacker's machine convinces the target that it is the gateway, and convinces the gateway that it is the target. This redirection ensures all traffic flowing between the target and the internet passes through the attacker, enabling interception and potential manipulation.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.