CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?
⚠ Common exam trap
A common mix-up: candidates confuse passive sniffing tools (Wireshark, tcpdump) with active MITM tools, assuming any tool that can capture traffic can also perform ARP poisoning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is a dedicated man-in-the-middle (MITM) attack tool that natively supports ARP poisoning. It sends forged ARP replies to both the victim and the default gateway, mapping the attacker's MAC address to the IP addresses of the other party. This allows the attacker to intercept, inspect, and modify traffic between the victim and the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful graphical user interface (GUI) tool primarily designed for passive network traffic analysis and protocol dissection. While it can capture and display the results of an ARP poisoning attack, it does not possess the active packet injection or manipulation functionalities necessary to initiate or perform the ARP poisoning itself. Its role is diagnostic, not offensive, focusing on understanding network communications post-capture.
- ✓
Ettercap
Why this is correct
Ettercap is a versatile and robust suite of tools specifically engineered for Man-in-the-Middle (MITM) attacks on local area networks. It excels at ARP poisoning by sending forged ARP replies to both the target host and the default gateway, effectively tricking them into routing traffic through the attacker's machine. This redirection allows for sniffing, content filtering, and other active manipulations of network communications.
- ✗
tcpdump
Why it's wrong here
tcpdump is a command-line utility for capturing and analyzing network traffic directly from the network interface. Similar to Wireshark, its function is purely passive observation and logging of packets, providing detailed information about network communications. It is not equipped with the mechanisms to actively craft and inject forged ARP packets onto the network, which is a prerequisite for performing ARP poisoning attacks.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is a renowned open-source utility primarily used for network discovery, security auditing, and port scanning. Its core functionality involves identifying hosts, services, and operating systems on a network, often utilizing ARP requests for local host discovery. However, Nmap's design does not include the capability to actively manipulate ARP tables or perform the continuous injection of forged ARP replies required for an ARP poisoning attack.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.