CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?
⚠ Common exam trap
It's easy for candidates to confuse tcpdump (which can capture packets and save pcap files) with Wireshark, failing to recognize that the question specifically asks for a tool to 'analyze' the pcap file, which requires Wireshark's advanced analysis capabilities rather than just capture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wireshark
Wireshark is the correct tool because it is designed for both live packet capture and offline analysis of pcap files. It provides a rich graphical interface with advanced filtering, protocol dissection, and statistical analysis capabilities, making it ideal for examining captured traffic for signs of an attack such as suspicious patterns, malformed packets, or known exploit signatures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ettercap
Why it's wrong here
Ettercap is primarily a suite for Man-in-the-Middle (MITM) attacks, enabling an attacker to intercept, manipulate, and drop network traffic between two hosts. While it can passively sniff traffic, its core functionality revolves around active ARP poisoning to redirect communications, rather than serving as a dedicated, comprehensive packet capture and analysis tool for general network monitoring. Its strength lies in active interception and session hijacking.
- ✗
tcpdump
Why it's wrong here
tcpdump is a powerful command-line packet analyzer that can indeed capture network traffic directly from an interface. It is highly efficient for quick captures and filtering on remote servers or environments without a graphical user interface. However, unlike Wireshark, tcpdump lacks an integrated graphical interface for visual analysis, protocol dissection, and interactive filtering, making it less suitable for comprehensive, deep-dive packet inspection by an analyst who requires visual aids.
- ✓
Wireshark
Why this is correct
Wireshark is the industry-standard graphical user interface (GUI) tool specifically designed for both capturing and interactively analyzing network packets in real-time or from saved capture files. It provides extensive protocol dissection capabilities, allowing analysts to drill down into individual packet headers and payloads, apply complex filters, and visualize network conversations. Its comprehensive features make it indispensable for network troubleshooting, security analysis, and protocol development.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is a renowned open-source utility primarily used for network discovery and security auditing. Its core function involves sending specially crafted packets to target hosts to determine available services, operating systems, and open ports. While Nmap interacts with network packets, it is fundamentally a port scanner and network reconnaissance tool, not a passive packet capture or analysis application designed to record and dissect ongoing network communications.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.