Next Countermeasure Against Persistent Network Sniffing Attacks
A large corporate network is being subjected to repeated sniffing attacks. To increase security, the company's IT department decides to implement a combination of several security measures. They permanently add the MAC address of the gateway to the ARP cache, switch to using IPv6 instead of IPv4, implement the use of encrypted sessions such as SSH instead of Telnet, and use Secure File Transfer Protocol instead of FTP. However, they are still faced with the threat of sniffing. Considering the countermeasures, what should be their next step to enhance network security?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests anti-sniffing detection capability: encrypted protocols and static ARP entries stop passive eavesdropping on specific traffic, but only scanning and monitoring tools actually detect an active sniffer on the segment.
After hardening ARP caches, migrating to IPv6, and replacing Telnet/FTP with SSH and SFTP, a network still needs active detection of sniffers. This question establishes that network scanning and monitoring tools are the correct next step to identify NICs running in promiscuous mode and spot ongoing packet-capture activity.
The most tempting wrong pick is A (use HTTP instead of HTTPS), because learners fixate on the 'usernames and passwords' wording and miss that HTTP is the weaker protocol — using it would worsen sniffing exposure, not improve it.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because after preventive controls (static ARP entry for the gateway, IPv6, SSH, SFTP) are in place, the remaining gap is detection of a sniffer already planted on the segment. Scanning and monitoring tools — for example, promiscuous-mode/NIC detection scans, IDS sensors, and traffic-anomaly monitors such as Sniffer, WildPackets, or Nagios-style tools taught in the CEH anti-sniffing module — identify hosts capturing all traffic and flag abnormal bandwidth or ARP patterns. This is the classic CEH countermeasure for the residual sniffing threat described.Why the Other Options Are Wrong
Option A is backwards: HTTP transmits credentials in clear text, so replacing HTTPS with HTTP would expose usernames and passwords to exactly the sniffing attacks the company is trying to stop. Option C is also inverted — network identification broadcasts (NetBIOS/name broadcasts) leak host information and should be disabled, not enabled, as part of anti-sniffing hardening. Option D is not a security measure at all: retrieving MAC addresses from the OS does nothing to prevent or detect sniffing, and the community correction notes that MAC addresses come from the NIC, not from the OS in any meaningful defensive sense.Community Comment Notes
The community strongly converges on B, with one comment observing that the tools "can help detect and identify suspicious activities, including sniffing attacks." JCSundaes cleanly eliminated the alternatives: "A, C, and D are wrong," pointing out that A should be HTTPS rather than HTTP, that network identification broadcasts should be disabled rather than enabled, and that MAC addresses come from the NIC. A lone dissenting vote argued for A on the grounds that encrypted packets defeat sniffers, but that reasoning actually supports keeping HTTPS, not abandoning it, so B remains the defensible answer.Exam Strategy
On CEH anti-sniffing questions, always pair the control type to the threat stage: encryption and static ARP stop passive capture, while scanning and monitoring tools detect active sniffers — the question asks what comes after prevention, so pick detection.
Frequently Asked Questions
Why is using HTTP instead of HTTPS not the right anti-sniffing step?
HTTP sends usernames and passwords in clear text, making them trivially capturable by a sniffer. The correct hardening is HTTPS, so option A reverses the required control.
How do network scanning and monitoring tools actually stop sniffing?
They detect hosts with NICs in promiscuous mode and flag abnormal ARP or bandwidth patterns, letting admins locate and remove the sniffer rather than merely blocking some traffic.
Why should network identification broadcasts be disabled, not enabled?
NetBIOS and similar name broadcasts reveal host details to attackers performing reconnaissance, so disabling them is a hardening step; enabling them increases exposure.