CEH Footprinting, Reconnaissance and Scanning Practice Question
Which of the following techniques involves sending crafted packets to a target to elicit responses that reveal the operating system?
⚠ Common exam trap
A common mix-up: candidates confuse 'active OS fingerprinting' with 'banner grabbing' because both involve sending packets, but banner grabbing targets application-layer banners (e.g., HTTP, FTP) and not the OS-level TCP/IP stack responses that fingerprinting analyzes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active OS fingerprinting
Active OS fingerprinting involves sending crafted packets (e.g., TCP SYN, FIN, or ICMP probes) to a target and analyzing the responses to deduce the operating system. Unlike passive methods, it actively interacts with the target, leveraging subtle differences in how various OSes implement TCP/IP stack behaviors (e.g., initial TTL values, window sizes, or TCP option ordering). This technique is commonly used by tools like Nmap with its `-O` flag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Passive OS fingerprinting
Why it's wrong here
Passive OS fingerprinting involves analyzing existing network traffic, such as observing TCP/IP headers, window sizes, Time-To-Live (TTL) values, and TCP options, without initiating any new connections or sending any packets to the target system. This method infers the operating system based on the unique characteristics and behaviors of the target's network stack as it communicates with other hosts. Therefore, it does not align with the technique of "sending crafted packets."
- ✗
Banner grabbing
Why it's wrong here
Banner grabbing is a technique used to retrieve information about services running on open ports by connecting to them and observing the initial response, often called a "banner." While it involves sending packets (e.g., a simple HTTP GET request or a telnet connection), its primary purpose is to identify the application and its version, not to directly infer the operating system through specially crafted probes that exploit TCP/IP stack differences. Any OS information gleaned is typically incidental or secondary.
- ✗
DNS enumeration
Why it's wrong here
DNS enumeration focuses on gathering information about domain names, hosts, and network services by querying Domain Name System (DNS) servers. This process involves requesting various DNS record types (e.g., A, MX, NS, SRV) to map out an organization's network infrastructure. It does not involve sending specially crafted packets to a target host's network stack to determine its operating system, nor is its objective OS identification.
- ✓
Active OS fingerprinting
Why this is correct
Active OS fingerprinting is the precise technique that involves sending specially crafted packets to a target system and analyzing the responses to infer its operating system. These crafted packets often include unusual TCP flags, specific IP options, or non-standard ICMP requests designed to exploit subtle differences in how various operating systems implement their TCP/IP stacks. The unique replies, or lack thereof, provide distinct clues about the target's OS and version.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.