CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?
⚠ Common exam trap
A common mix-up: candidates confuse passive sniffing tools like Wireshark with active interception tools, or assume Metasploit's broad capabilities include ARP spoofing as its primary function, when Ettercap is the specialized tool for this task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing capabilities. It actively sends forged ARP replies to poison the ARP cache of target hosts, allowing the attacker to intercept, modify, or drop traffic between them. This makes it the standard tool for ARP-based MITM attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
Nmap is a port scanner, not designed for ARP spoofing.
- ✓
Ettercap
Why this is correct
Ettercap supports ARP poisoning, DNS spoofing, and other MITM techniques.
- ✗
Wireshark
Why it's wrong here
Wireshark is a packet analyzer, not an attack tool.
- ✗
Metasploit
Why it's wrong here
Metasploit is an exploitation framework; it can be used in conjunction with other tools but is not the primary ARP spoofing tool.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO tools are commonly used for ARP poisoning attacks?
medium- A.Wireshark
- ✓ B.Cain & Abel
- C.tcpdump
- ✓ D.Ettercap
- E.Nmap
Why B: Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.
Variation 2. A penetration tester needs to perform ARP poisoning to intercept traffic between two hosts on the same subnet. Which tool would be the most appropriate choice for this task?
medium- A.tcpdump
- ✓ B.Ettercap
- C.Nmap
- D.Wireshark
Why B: Ettercap is the most appropriate tool for ARP poisoning because it is specifically designed for man-in-the-middle (MITM) attacks on a local area network (LAN). It automates ARP spoofing by sending forged ARP replies to both target hosts, poisoning their ARP caches so that traffic intended for the other host is redirected through the attacker's machine, enabling interception and modification of packets.
Variation 3. Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?
medium- A.Wireshark
- ✓ B.Ettercap
- C.tcpdump
- D.Nmap
Why B: Ettercap is a dedicated man-in-the-middle (MITM) attack tool that natively supports ARP poisoning. It sends forged ARP replies to both the victim and the default gateway, mapping the attacker's MAC address to the IP addresses of the other party. This allows the attacker to intercept, inspect, and modify traffic between the victim and the gateway.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.