Which Network-Level Session Hijacking Uses Forged ICMP and ARP Spoofing?

312-50v12 By islever Editorial Last updated

Session Hijacking Sniffing

Short answer

D Man-in-the-middle attack using forged ICMP and ARP spoofing inserts the attacker's machine into the path and reroutes packets between client and server.

Question

Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company. While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets. Which of the following types of network-level session hijacking attacks is Jake studying?
  1. TCP/IP Hijacking
  2. RST Hijacking
  3. UDP Hijacking
  4. Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing Correct Answer

Key Takeaways

The question tests recognition of the MITM/ICMP-ARP spoofing variant of network-level session hijacking; the trap is confusing it with TCP/IP or RST hijacking, which inject or reset packets rather than reroute the path.

Network-level session hijacking includes man-in-the-middle attacks that use forged ICMP redirects and ARP spoofing to reroute traffic through the attacker's machine. This page explains why that technique, not TCP/IP, RST, or UDP hijacking, is the answer.

Common mistake: Learners often choose TCP/IP Hijacking because it is the broadest session-hijacking term, but it does not describe inserting a machine into the path via forged ICMP and ARP to reroute packets.

Expert Analysis

Why the Answer Is Correct

Option D describes the attacker placing their host between client and server and using forged ICMP redirects plus ARP spoofing so traffic appears to follow the original path while actually being rerouted through the attacker. This is the defining network-level session hijacking technique in CEH material for MITM using forged ICMP and ARP spoofing. The scenario's emphasis on "inserts their machine into the communication" and "reroute the packets" maps directly to that option. It is not merely resetting or injecting into an existing TCP stream.

Why the Other Options Are Wrong

A TCP/IP Hijacking involves taking over an established TCP session, often by predicting sequence numbers or injecting packets, not by rerouting the path with forged ICMP/ARP. B RST Hijacking sends forged TCP RST packets to tear down a session, which is a DoS-like disruption rather than inserting a machine into the path. C UDP Hijacking targets connectionless UDP communications and does not use ICMP redirects/ARP spoofing to reroute a client-server path. D is the only option that names the MITM forgery technique.

Community Comment Notes

Community voters unanimously selected D, and one learner simply restated "Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing." Another commenter, agelbahri, cited "CEH v12 page 1565" as the source, reinforcing that this exact wording comes from the official courseware. No commenter argued for TCP/IP, RST, or UDP hijacking.

Exam Strategy

In session-hijacking questions, separate path-rewriting techniques (ICMP redirect/ARP spoofing MITM) from stream takeover (TCP/IP hijacking) and teardown (RST hijacking). Match the scenario's verbs — 'inserts', 'reroute' — to the MITM option.

Frequently Asked Questions

Why is TCP/IP hijacking not the answer when the attacker reroutes packets?

TCP/IP hijacking takes over an existing TCP session by manipulating sequence numbers; it does not rely on forged ICMP redirects and ARP spoofing to insert a host into the path.

What distinguishes RST hijacking from MITM with forged ICMP and ARP?

RST hijacking sends forged TCP reset packets to drop a session, while the MITM ICMP/ARP technique reroutes traffic through the attacker's machine.

More 312-50v12 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. insaniunt 👍 2 Answered D
    D. Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing
  2. agelbahri 👍 1 Answered D
    CEH v12 page 1565

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide