Overview
Domain 4 is the heaviest part of the exam, covering attacks on networks and their perimeter defenses. Sniffing covers capturing traffic and the attacks that enable it, such as MAC flooding, ARP poisoning, DHCP attacks and DNS poisoning, with their switch-level countermeasures. Social engineering covers manipulating people through phishing, pretexting, impersonation and insider threats. Denial-of-service covers DoS and DDoS techniques, botnets and mitigations. Session hijacking covers taking over established sessions at the application and network layers. Evading IDS, firewalls and honeypots covers the techniques attackers use to slip past detection and the defenses that catch them.
At nearly a quarter of the exam, this domain decides many pass/fail outcomes. It is also where candidates lose the most absolute points, because the sniffing and evasion subsections demand precise knowledge of which attack produces which traffic pattern and which control counters it.
How it's tested
Expect scenario questions that describe network traffic, an attack symptom, a social engineering situation, or a detection-evasion need, and ask which attack it is, which countermeasure applies, or which evasion technique fits. Precise attack-to-control mapping is the key skill. Read the full scenario and every option carefully before deciding.
-
Match attack to countermeasure
A sniffing or network attack is described, and you must choose the switch-level or network control that stops it.
-
Identify the attack
A traffic pattern or symptom is described, and you must name the specific attack, distinguishing similar ones.
-
Evasion technique
A need to bypass an IDS, firewall or honeypot is described, and you must choose the evasion technique or its defense.
An attacker floods a switch with fake MAC addresses until its address table overflows, causing it to broadcast traffic to all ports so the attacker can sniff it. This is MAC flooding, not ARP poisoning, which instead forges ARP replies to associate the attacker's MAC with another host's IP. The countermeasure for MAC flooding is switch port security, which limits the MACs per port.
Domains 5
Official domains from the EC-Council outline, in outline order.
4.1 SniffingCapturing traffic and the attacks that enable it, with switch-level countermeasures.
- What it means
- Sniffing covers passive and active capture of network traffic and the attacks that enable active sniffing on switched networks: MAC flooding, DHCP starvation and spoofing, ARP poisoning, MAC spoofing, DNS poisoning, and spoofing attacks, plus sniffing tools and countermeasures such as port security, DHCP snooping and dynamic ARP inspection.
- What to understand
- Passive sniffing works on hubs or mirrored ports; active sniffing is needed on switches and relies on attacks that disrupt normal switching. Each attack has a specific countermeasure: port security against MAC flooding, DHCP snooping against DHCP attacks, and dynamic ARP inspection against ARP poisoning. The exam tests these pairings closely.
- How it shows up
- A traffic pattern or attack is described, and you must identify it and choose its countermeasure.
- Common confusion
- Confusing ARP poisoning with MAC flooding, or DHCP starvation with DHCP spoofing. Each has a distinct mechanism and defense.
4.2 Social EngineeringManipulating people through phishing, pretexting, impersonation and insider threats.
- What it means
- Social engineering covers human-based attacks (impersonation, pretexting, tailgating, shoulder surfing), computer-based attacks (phishing, spear phishing, whaling, smishing, vishing), mobile-based attacks, insider threats, identity theft, and countermeasures such as awareness training and verification procedures.
- What to understand
- Social engineering exploits people rather than technology and is often the easiest entry. Phishing is broad, spear phishing is targeted, and whaling targets executives. The strongest defenses are awareness, verification procedures and a culture where people can report suspicious contact.
- How it shows up
- A human-targeted attack is described, and you must name the technique or choose the countermeasure.
- Common confusion
- Confusing phishing, spear phishing and whaling. Spear phishing is targeted; whaling targets senior executives specifically.
4.3 Denial-of-ServiceDoS and DDoS techniques, botnets and mitigations.
- What it means
- This covers denial-of-service and distributed denial-of-service attacks, including volumetric, protocol and application-layer attacks, amplification and reflection, botnets that power large attacks, and mitigations such as rate limiting, filtering, content delivery networks and upstream scrubbing.
- What to understand
- DoS targets availability. Volumetric attacks saturate bandwidth, protocol attacks exhaust connection resources, and application-layer attacks target specific services with fewer requests. A firewall alone cannot stop a large volumetric attack that saturates the link, so upstream or CDN mitigation is needed.
- How it shows up
- A DoS scenario or mitigation need is described, and you must identify the attack type or the right defense.
- Common confusion
- Assuming a firewall stops a large volumetric DDoS. Volumetric floods can saturate the link before traffic reaches the firewall.
4.4 Session HijackingTaking over established sessions at the application and network layers.
- What it means
- Session hijacking covers taking over a valid session, at the application layer (stealing or predicting session tokens, cross-site scripting, session fixation) and at the network layer (TCP sequence prediction, man-in-the-middle, packet injection), plus countermeasures such as strong random tokens, encryption and re-authentication.
- What to understand
- Application-layer hijacking steals or forges session identifiers, while network-layer hijacking manipulates the underlying connection. Encrypted sessions, strong unpredictable tokens and binding sessions to additional factors reduce the risk. It differs from spoofing because it rides an already authenticated session.
- How it shows up
- A session takeover scenario is described, and you must identify the layer, the technique or the countermeasure.
- Common confusion
- Confusing session hijacking with spoofing. Hijacking takes over an existing authenticated session rather than impersonating from scratch.
4.5 Evading IDS, Firewalls, and HoneypotsTechniques to bypass detection and the defenses that catch them.
- What it means
- This covers how IDS, IPS, firewalls and honeypots work and the techniques used to evade them: fragmentation, session splicing, unicode and other encoding, protocol violations, tunneling, and detecting honeypots, along with the countermeasures that defeat each evasion.
- What to understand
- Signature-based IDS can be evaded by altering traffic so it no longer matches a signature, for example through fragmentation or encoding, while behavior-based detection is harder to fool this way. Honeypots are decoys, and attackers try to detect them to avoid wasting effort or revealing themselves. The exam pairs each evasion technique with its defense.
- How it shows up
- An evasion need or a detection system is described, and you must choose the technique or the countermeasure.
- Common confusion
- Assuming an evasion that beats a signature-based IDS also beats a behavior-based one. The two detect differently.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
MAC flooding vs. ARP poisoning
MAC flooding overflows the switch table to force broadcasting; ARP poisoning forges ARP replies to redirect traffic.
- Remember
- Port security counters flooding; dynamic ARP inspection counters poisoning.
- Tested as
- Sniffing questions.
- Trap
- Confusing the two mechanisms.
-
DHCP starvation vs. DHCP spoofing
Starvation exhausts the DHCP pool; spoofing runs a rogue DHCP server.
- Remember
- DHCP snooping counters both.
- Tested as
- Sniffing questions.
- Trap
- Mixing up the two attacks.
-
Passive vs. active sniffing
Passive captures on hubs or mirrored ports; active requires attacks on switches.
- Remember
- Switched networks need active sniffing.
- Tested as
- Sniffing questions.
- Trap
- Assuming passive sniffing works on any switch.
-
Phishing vs. spear phishing vs. whaling
Phishing is broad, spear phishing is targeted, whaling targets executives.
- Remember
- Whaling is a subset aimed at senior leaders.
- Tested as
- Social engineering questions.
- Trap
- Using the terms loosely.
-
Volumetric vs. protocol vs. application DoS
Volumetric saturates bandwidth, protocol exhausts connection state, application targets services with few requests.
- Remember
- Firewalls cannot stop link-saturating floods.
- Tested as
- DoS questions.
- Trap
- Using a firewall against a volumetric flood.
-
Amplification and reflection
Spoofing a victim's address to make servers send large responses to it.
- Remember
- DNS and NTP are common amplifiers.
- Tested as
- DDoS questions.
- Trap
- Confusing amplification with a direct flood.
-
Application vs. network session hijacking
Application-layer steals session tokens; network-layer manipulates the connection.
- Remember
- Strong tokens and encryption counter it.
- Tested as
- Session hijacking questions.
- Trap
- Confusing hijacking with spoofing.
-
IDS evasion techniques
Fragmentation, session splicing, encoding and protocol violations alter traffic to dodge signatures.
- Remember
- They defeat signature-based detection more than behavior-based.
- Tested as
- Evasion questions.
- Trap
- Assuming they beat all detection types.
-
Signature vs. behavior-based detection
Signature matches known patterns; behavior detects anomalies.
- Remember
- Evasion that alters signatures may still trip behavior detection.
- Tested as
- Evasion questions.
- Trap
- Treating all IDS as signature-based.
-
Honeypot detection
Attackers probe for decoy characteristics to avoid honeypots.
- Remember
- Honeypots are decoys used to study or divert attackers.
- Tested as
- Honeypot questions.
- Trap
- Treating a honeypot as a production defense.
-
Switch-level countermeasures
Port security, DHCP snooping, dynamic ARP inspection and STP protections.
- Remember
- Each counters a specific sniffing attack.
- Tested as
- Countermeasure questions.
- Trap
- Applying the wrong control to an attack.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
MAC flooding vs. ARP poisoning vs. DHCP attacks
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| MAC flooding | Overflows the switch MAC table to force broadcasting | Countered by port security | Confusing it with ARP poisoning |
| ARP poisoning | Forges ARP replies to redirect traffic | Countered by dynamic ARP inspection | Confusing it with MAC flooding |
| DHCP starvation/spoofing | Exhausts the pool or runs a rogue DHCP server | Countered by DHCP snooping | Mixing starvation with spoofing |
Volumetric vs. protocol vs. application-layer DoS
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Volumetric | Saturates bandwidth | Needs upstream or CDN mitigation | Using a firewall to stop it |
| Protocol | Exhausts connection resources such as SYN state | Targets network and transport layers | Confusing it with volumetric |
| Application-layer | Targets a service with relatively few requests | Low traffic, hard to spot | Expecting high traffic volume |
Phishing vs. spear phishing vs. whaling vs. vishing
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Phishing | Broad deceptive messages | Untargeted | Calling targeted attacks phishing |
| Spear phishing | Targeted at specific individuals | Personalized | Confusing it with whaling |
| Whaling | Targets senior executives | High-value targets | Treating it as generic phishing |
| Vishing | Voice-based social engineering | Uses phone calls | Confusing it with smishing (SMS) |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Wrong sniffing attack
- What candidates pick
- Identify a switch-table overflow as ARP poisoning.
- Why it looks right
- Both enable sniffing on switches.
- Why it's wrong
- Overflowing the MAC table to force broadcasting is MAC flooding; ARP poisoning forges ARP replies.
Clue to watch for The description is about the switch table filling up versus forged ARP replies.
-
Firewall stops the flood
- What candidates pick
- Add firewall rules to stop a bandwidth-saturating DDoS.
- Why it looks right
- Firewalls block traffic.
- Why it's wrong
- Volumetric floods saturate the link before the firewall, so upstream or CDN mitigation is required.
Clue to watch for The internet link is saturated by the attack.
-
Hijacking is spoofing
- What candidates pick
- Describe taking over an authenticated session as spoofing.
- Why it looks right
- Both involve impersonation.
- Why it's wrong
- Session hijacking takes over an existing authenticated session; spoofing impersonates from the start.
Clue to watch for The attacker rides an already established session.
-
Evasion beats everything
- What candidates pick
- Assume fragmentation that evades a signature IDS also evades behavior-based detection.
- Why it looks right
- The evasion worked once.
- Why it's wrong
- Behavior-based detection looks for anomalies, not signatures, so it may still catch the activity.
Clue to watch for The defense is described as behavior-based or anomaly-based.
-
Wrong countermeasure
- What candidates pick
- Apply port security to stop ARP poisoning.
- Why it looks right
- Port security is a switch control.
- Why it's wrong
- Port security counters MAC flooding; dynamic ARP inspection counters ARP poisoning.
Clue to watch for The attack is forged ARP replies, not table overflow.
-
Whaling is just phishing
- What candidates pick
- Treat an attack targeting the CFO as generic phishing.
- Why it looks right
- It is a phishing email.
- Why it's wrong
- Targeting a senior executive is whaling, a specific subset.
Clue to watch for The target is a senior executive.
Answer framework
For any Domain 4 network attack scenario, use these steps before choosing an answer.
- Identify which of the five modules the scenario belongs to: sniffing, social engineering, DoS, session hijacking or evasion.
- For sniffing, match the specific attack to its mechanism and then to its switch-level countermeasure, keeping similar attacks distinct.
- For DoS, classify the attack as volumetric, protocol or application-layer, and choose mitigation that matches, using upstream defenses for floods.
- For session hijacking, determine the layer and distinguish it from spoofing, then apply strong tokens, encryption or re-authentication.
- For evasion, name the technique and the detection type it targets, remembering that behavior-based detection resists signature evasion, and match each attack to the control that specifically stops it.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Give this domain the most study time; at 24% it is the largest and where candidates lose the most points. Start with sniffing, because it is the single biggest loss area. Build a table pairing each attack (MAC flooding, ARP poisoning, DHCP starvation, DHCP spoofing, DNS poisoning) with its mechanism and its exact countermeasure (port security, dynamic ARP inspection, DHCP snooping). Drill the look-alike pairs until you never confuse them.
Next, study evasion, the second biggest loss area. Learn each technique, the detection type it defeats, and why behavior-based detection resists signature evasion.
Then cover DoS, session hijacking and social engineering. For DoS, learn the three attack classes and why firewalls cannot stop volumetric floods. For session hijacking, separate the layers and distinguish it from spoofing. For social engineering, learn the phishing variants.
A lab with a packet capture tool and a safe test network makes the sniffing attacks concrete. Afterwards, move to Domain 5, web application hacking.
FAQ
How much of CEH v13 is Domain 4?
Network and Perimeter Hacking is about 24% of the exam, roughly 30 questions, the largest domain.
What is the difference between MAC flooding and ARP poisoning?
MAC flooding overflows the switch's address table to force it to broadcast traffic. ARP poisoning forges ARP replies to redirect traffic to the attacker. They have different countermeasures.
Can a firewall stop a DDoS?
Not a large volumetric one, which can saturate the internet link before traffic reaches the firewall. Upstream filtering or a content delivery network is needed.
What is the difference between session hijacking and spoofing?
Hijacking takes over an existing authenticated session, while spoofing impersonates an identity from the start.
Why is this domain considered the hardest?
It is the largest and its sniffing and evasion subsections demand precise attack-to-countermeasure knowledge, where candidates most often confuse similar attacks.
Does evading a signature IDS defeat all detection?
No. Signature evasion alters traffic to avoid known patterns, but behavior-based detection looks for anomalies and may still catch the activity.
How does Domain 4 connect to the rest of the exam?
It applies the reconnaissance from Domain 2 and the system hacking techniques from Domain 3 against networks and their perimeter defenses.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 4 knowledge
You have covered sniffing, social engineering, DoS, session hijacking and evasion. Test whether you can match each attack to its countermeasure under exam conditions.