Certified Ethical Hacker (CEH) Network Attacks, Sniffing, and Perimeter Evasion Syllabus

Network Attacks, Sniffing, and Perimeter Evasion syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Network Attacks, Sniffing, and Perimeter Evasion in Certified Ethical Hacker (CEH), not a summary of it.

1. 1

   Sniffing

   4 topics

   • Sniffing Concepts
     • Passive vs active sniffing
     • Hardware protocol analyzers and SPAN ports
   • MAC, ARP, and DHCP Attacks
     • MAC flooding and CAM table overflow
     • ARP poisoning and spoofing
     • DHCP starvation and rogue DHCP
   • DNS and Spoofing Attacks
     • DNS cache poisoning
     • MAC spoofing
   • Sniffing Tools and Countermeasures
     • Wireshark and tcpdump
     • Detection: promiscuous mode and DAI
2. 2

   Denial-of-Service Attacks

   4 topics

   • DoS and DDoS Concepts
     • Attack categories: volumetric, protocol, application
   • Attack Techniques
     • SYN flood, UDP flood, ICMP flood
     • Slowloris and HTTP flood
     • Amplification and reflection attacks
   • Botnets
     • Botnet architecture and command-and-control
   • DoS Detection and Countermeasures
     • Rate limiting and traffic scrubbing
3. 3

   Session Hijacking

   4 topics

   • Session Hijacking Concepts
     • Application-level vs network-level
   • Application-Level Hijacking
     • Session token prediction and theft
     • Cross-site scripting and session fixation
   • Network-Level Hijacking
     • TCP/IP hijacking and sequence prediction
     • Man-in-the-middle and UDP hijacking
   • Countermeasures
     • Secure tokens, HSTS, and encryption
4. 4

   Evading IDS, Firewalls, and Honeypots

   4 topics

   • IDS, IPS, Firewall, and Honeypot Concepts
     • Detection types: signature, anomaly, stateful
   • IDS/IPS Evasion
     • Insertion, evasion, and obfuscation
     • Fragmentation and session splicing
   • Firewall Evasion
     • HTTP, SSH, and DNS tunneling
     • Bypassing via proxies and source routing
   • Detecting and Defeating Honeypots

Network Attacks, Sniffing, and Perimeter Evasion flashcards for Certified Ethical Hacker (CEH)

18 of 55 cards from the Network Attacks, Sniffing, and Perimeter Evasion deck — real questions with worked answers.

1. What is sniffing in the context of network security?

   The process of capturing and monitoring data packets passing through a network using a packet-capture tool, often to steal information such as credentials, emails, or session data.

2. What is the difference between passive and active sniffing?

   Passive sniffing captures traffic on a hub-based network without injecting packets (traffic is already broadcast to all ports). Active sniffing injects traffic (e.g., ARP poisoning, MAC flooding) into a switched network to redirect traffic to the attacker.

3. Why does a switched network require active sniffing while a hub does not?

   A hub broadcasts every frame to all ports, so any NIC in promiscuous mode can capture it. A switch forwards frames only to the destination port based on its CAM table, so the attacker must actively manipulate the switch (e.g., MAC flooding, ARP poisoning) to receive other hosts' traffic.

4. What is promiscuous mode on a network interface card?

   A NIC mode in which the card passes all received frames to the CPU rather than only those addressed to its own MAC, allowing the host to capture all traffic on the segment.

5. Which protocols are considered inherently vulnerable to sniffing because they send data in cleartext?

   Telnet, HTTP, FTP, SMTP, POP, IMAP, SNMP (v1/v2), and rlogin — they transmit credentials and data without encryption.

6. What is MAC flooding (CAM table overflow) and what is its effect?

   An attack that floods a switch with many frames using bogus source MAC addresses, filling the CAM/MAC table. When full, the switch fails open and behaves like a hub, broadcasting frames to all ports so the attacker can sniff traffic. (Tool example: macof)

7. What is ARP spoofing (ARP poisoning)?

   An attack that sends forged ARP reply messages to associate the attacker's MAC address with the IP address of another host (e.g., the gateway), redirecting that host's traffic through the attacker for man-in-the-middle interception.

8. Why is ARP inherently vulnerable to spoofing?

   ARP is stateless and unauthenticated — hosts accept and cache ARP replies even if they never sent a request (gratuitous ARP), so an attacker can poison ARP caches with false IP-to-MAC mappings.

9. What is a DHCP starvation attack?

   An attacker broadcasts many DHCP requests with spoofed MAC addresses to exhaust the DHCP server's pool of IP addresses, causing a denial of service so legitimate clients cannot obtain addresses. (Tool example: Yersinia, Dhcpstarv)

10. What is a rogue DHCP server attack?

    An attacker sets up an unauthorized DHCP server that responds to client requests faster than the legitimate server, assigning clients a malicious default gateway/DNS so traffic is routed through the attacker (man-in-the-middle).

11. What is the primary switch countermeasure against MAC flooding and DHCP starvation?

    Port security — limit the number of MAC addresses allowed per switch port; DHCP snooping additionally blocks rogue DHCP servers on untrusted ports.

12. What is DNS spoofing (DNS poisoning)?

    An attack that supplies false DNS resolution data so a domain name resolves to an attacker-controlled IP, redirecting victims to a malicious server. Types include intranet, internet, proxy server, and DNS cache poisoning.

13. What is DNS cache poisoning?

    Injecting forged DNS records into a DNS resolver's cache so the resolver returns the attacker's IP for a domain to all users querying it until the cache entry's TTL expires.

14. What is the difference between ARP spoofing and DNS spoofing in terms of layer and target?

    ARP spoofing operates at Layer 2 (data link), poisoning IP-to-MAC mappings on the local segment. DNS spoofing operates at the application/name-resolution layer, falsifying domain-name-to-IP mappings, and can affect users beyond the local segment.

15. Name three common packet-sniffing tools and their general use.

    Wireshark (GUI protocol analyzer for capture/analysis), tcpdump/WinDump (command-line capture), and Ettercap (MITM and active sniffing). Others: Cain & Abel, dsniff, macof.

16. What display filter would show only HTTP traffic in Wireshark, and what is a capture filter equivalent?

    Display filter: http. Capture filter (BPF): tcp port 80.

17. List three key countermeasures against sniffing attacks.

    1) Use encryption (HTTPS/TLS, SSH, IPsec, VPN) so captured data is unreadable. 2) Use static ARP entries and Dynamic ARP Inspection (DAI). 3) Use switches with port security/DHCP snooping and avoid hubs; detect promiscuous NICs.

18. How can promiscuous-mode (sniffing) hosts be detected?

    Using methods such as the ARP method (send ARP to a non-broadcast MAC; only sniffing hosts reply), the ping/ICMP method with a wrong MAC, the DNS method (sniffers may reverse-resolve captured IPs), and tools like Nmap's sniffer-detect script or PromqryUI.

See more Network Attacks, Sniffing, and Perimeter Evasion flashcards →

Planning Network Attacks, Sniffing, and Perimeter Evasion for Certified Ethical Hacker (CEH)

Network Attacks, Sniffing, and Perimeter Evasion (Certified Ethical Hacker (CEH)) FAQ