CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO tools are commonly used for ARP poisoning attacks?
⚠ Common exam trap
A common mix-up: candidates confuse passive sniffing tools (like Wireshark or tcpdump) with active attack tools, assuming any network tool can perform ARP poisoning, but only tools specifically designed to send forged ARP packets (like Cain & Abel and Ettercap) can execute the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cain & Abel
Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark functions as a passive network protocol analyzer, meticulously capturing and displaying network traffic for inspection and troubleshooting. While it can effectively monitor and identify the results of an ARP poisoning attack by observing forged ARP replies, it lacks the inherent capability to actively craft and inject malicious ARP packets into the network. Its primary role is diagnostic, providing visibility into network communications rather than initiating offensive actions like cache manipulation.
- ✓
Cain & Abel
Why this is correct
Cain & Abel is a well-known password recovery and network sniffing tool primarily designed for Microsoft Windows operating systems. Among its extensive features, it specifically incorporates robust ARP poisoning functionalities, allowing an attacker to perform Man-in-the-Middle (MITM) attacks by sending forged ARP replies to redirect network traffic. This enables the interception of data, including credentials, between targeted hosts on a local area network.
- ✗
tcpdump
Why it's wrong here
tcpdump is a powerful command-line packet analyzer that allows users to capture and display TCP/IP and other network packets directly from the network interface. While it is invaluable for network troubleshooting, security analysis, and monitoring network activity, it is strictly a passive observation tool. tcpdump cannot generate or inject custom packets, meaning it lacks the necessary functionality to actively perform an ARP poisoning attack by sending crafted ARP replies to manipulate host caches.
- ✓
Ettercap
Why this is correct
Ettercap is a versatile and comprehensive suite specifically engineered for Man-in-the-Middle (MITM) attacks on switched LANs, offering both graphical and command-line interfaces. It excels at ARP poisoning, which is its primary method for redirecting traffic by sending forged ARP responses to targets, enabling sniffing of secure connections, content filtering, and active packet manipulation. Its robust capabilities make it a go-to tool for various network penetration testing and security auditing tasks.
- ✗
Nmap
Why it's wrong here
Nmap, or Network Mapper, is an open-source utility widely used for network discovery and security auditing, primarily functioning as a port scanner. Its core capabilities involve identifying live hosts on a network, discovering open ports, detecting operating systems, and enumerating services running on those hosts. While Nmap is an essential reconnaissance tool, it is not designed to perform active ARP poisoning attacks; it lacks the specific modules or functionalities to craft and inject malicious ARP packets for cache manipulation.
Go deeper
Related to this question
Learn chapter
Sniffing
Key term
Evil Twin Attack
An evil twin attack is a type of wireless hacking where a fake Wi-Fi access point mimics a legitimate one to trick users into connecting, allowing the attacker to intercept traffic and steal data.
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.