CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ettercap

  Why it's wrong here

  Ettercap is primarily a comprehensive suite for man-in-the-middle (MITM) attacks, specializing in ARP spoofing or ARP poisoning. It manipulates the Address Resolution Protocol cache on target hosts to redirect network traffic through the attacker's machine, enabling passive sniffing, active content filtering, and session hijacking. While powerful for traffic interception and manipulation, Ettercap's design does not include functionality for generating a high volume of random MAC addresses to overwhelm a switch's CAM table, which is the mechanism of MAC flooding.

• ✗

  Wireshark

  Why it's wrong here

  Wireshark is a widely used, open-source network protocol analyzer designed for passive network monitoring and troubleshooting. Its core function involves capturing live network traffic and displaying detailed packet data, allowing users to inspect protocols, analyze network performance, and diagnose communication issues. Wireshark is a forensic and diagnostic tool that observes and interprets existing network activity; it does not actively generate or inject malicious traffic, nor does it possess capabilities to launch denial-of-service attacks like MAC flooding.

• ✗

  Nmap

  Why it's wrong here

  Nmap, or Network Mapper, is a robust utility primarily used for network discovery and security auditing. Its capabilities include identifying active hosts on a network, detecting open ports, determining operating systems, and identifying service versions running on target machines. Nmap achieves this through various scanning techniques that send crafted packets and analyze responses. While it can generate network traffic for reconnaissance, Nmap is not designed to perform MAC flooding by overwhelming a switch's CAM table with a deluge of spoofed MAC addresses; its focus is on mapping and enumeration, not denial-of-service.

• ✓

  macof

  Why this is correct

  macof, a tool within the dsniff suite, is specifically engineered to execute MAC flooding attacks against network switches. It operates by rapidly generating and transmitting a massive number of Ethernet frames, each containing a unique, randomly generated source MAC address. This malicious activity aims to exhaust the switch's Content Addressable Memory (CAM) table, forcing the switch to enter a "fail-open" or "hub mode" state. In this state, the switch broadcasts all incoming traffic to every connected port, thereby allowing an attacker to passively sniff all network communications.

Go deeper

Related to this question