CEH Scanning Networks and Enumeration Practice Question

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

⚠ Common exam trap

Many candidates confuse traceroute with ping (which only tests reachability and RTT, not hop-by-hop path discovery) or assume banner grabbing can reveal network topology, but only traceroute systematically identifies each intermediate device along the route.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Traceroute

Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Traceroute
Why this is correct
Traceroute is a fundamental network diagnostic tool that maps the path a packet takes to reach a destination by strategically manipulating the IP packet's Time To Live (TTL) field. It sends a series of packets, starting with a TTL of 1 and incrementing it, causing intermediate routers to decrement the TTL to zero and respond with an ICMP Time Exceeded message. Each ICMP response reveals an intermediate router (hop), effectively tracing the full network path hop-by-hop and identifying the sequence of devices. This method is precisely designed for network topology discovery.
✗
Banner grabbing
Why it's wrong here
Banner grabbing involves connecting to an open port on a target system and observing the service's initial response, often called a banner. This technique primarily identifies the specific application, its version, and sometimes the underlying operating system running on that particular host. While useful for identifying vulnerable services and enumerating host-specific software, it provides no information about the network path or the sequence of routers packets traverse to reach the target.
✗
DNS enumeration
Why it's wrong here
DNS enumeration systematically queries Domain Name System (DNS) servers to gather information about hostnames, IP addresses, mail servers, and other records within a specific domain. This process helps map the logical structure of an organization's online presence and identify potential targets by resolving names to addresses. However, it focuses on discovering domain assets and their associated IP addresses, not on tracing the physical or logical routing path packets take across the network to reach those hosts.
✗
SNMP walk
Why it's wrong here
An SNMP walk is used to query a Simple Network Management Protocol (SNMP) agent on a network device to retrieve a hierarchical tree of Management Information Base (MIB) data. This data provides detailed operational statistics, configuration parameters, and status information about the device itself, such as interface status, CPU usage, or its internal routing table. While it offers deep insight into a single device's state and configuration, an SNMP walk does not actively discover or map the end-to-end network path between multiple devices across the internetwork.

Go deeper

CEH Scanning Networks and Enumeration Practice Question

Why each option matters

Option-by-option breakdown

Related to this question