CEH Footprinting, Reconnaissance and Scanning Practice Question
Which of the following tools would be BEST to use for identifying all live hosts in a large IP range (e.g., 10.0.0.0/8) quickly?
⚠ Common exam trap
EC-Council often tests the distinction between scanning speed and functionality, where candidates mistakenly choose Nmap (a versatile tool) for large-range host discovery without recognizing that its default scanning modes are too slow for a /8 subnet, whereas Masscan is purpose-built for speed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Masscan
Masscan is the best choice because it is designed for high-speed scanning across large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. It uses asynchronous transmission and raw sockets to quickly identify live hosts by sending SYN probes and analyzing responses, making it ideal for scanning a /8 subnet (16.7 million addresses) in minutes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Masscan
Why this is correct
Masscan is exceptionally well-suited for rapid host discovery across vast IP ranges due to its asynchronous, custom-built TCP SYN scanner. It can transmit millions of packets per second, bypassing the operating system's network stack by using raw sockets to achieve unparalleled scanning speed. This makes it the optimal choice for identifying live hosts quickly over large networks or the entire internet.
- ✗
OpenVAS
Why it's wrong here
OpenVAS is primarily a comprehensive vulnerability scanner designed to identify security weaknesses on already discovered hosts, not for initial, rapid host discovery. Its scanning process involves detailed checks and authenticated scans, which are resource-intensive and time-consuming, making it inefficient for quickly identifying a large number of live hosts across broad IP ranges. It operates at a higher layer of reconnaissance, focusing on depth rather than breadth of initial network enumeration.
- ✗
Nmap with -sL flag
Why it's wrong here
Nmap with the -sL flag performs a 'list scan,' which is purely an enumeration technique that resolves target IP addresses via DNS but does not send any packets to the target hosts. Consequently, it cannot actively determine if a host is live or reachable on the network because it never interacts with the target systems. This flag is useful for generating a list of targets for later scanning but is ineffective for actual live host identification.
- ✗
hping3
Why it's wrong here
hping3 is a powerful, command-line oriented TCP/IP packet assembler/analyzer, primarily used for custom packet crafting, firewall testing, and denial-of-service attacks. While it can send various types of packets to test host responsiveness, it is fundamentally a single-threaded tool designed for granular control over individual packets or small target sets. Its operational model makes it significantly slower and less efficient than dedicated high-speed scanners for identifying live hosts across extensive IP ranges.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.