How to Master One of the Hardest Parts of the EC-Council CEH Exam: Network and Perimeter Hacking

Network and Perimeter Hacking is the largest domain on the Certified Ethical Hacker (CEH™) exam, and many candidates say it’s where they lose the most points. The challenge isn’t one hard concept. It’s five different topics packed into one domain, each with its own attacks, tools, and countermeasures that sound alike.

Questions also tend to describe symptoms rather than name the attack. You might read that a switch is suddenly forwarding traffic to every port, or that an IDS missed a packet the target accepted, and you need to recognize what’s happening and choose the best defense.

In this guide, we’ll walk you through what the domain covers, the core concepts in each topic, the traps to avoid, and two sample scenarios.

What Does Network and Perimeter Hacking Cover on the CEH Exam?

In the CEH Exam Blueprint v5.0, Network and Perimeter Hacking is Domain 4. It makes up 24% of the exam, or 30 of the 125 questions, split evenly across five topics:

Sniffing (6 questions): Sniffing concepts, MAC attacks, DHCP attacks, ARP poisoning, spoofing, DNS poisoning, tools, countermeasures, and detection techniques.
Social Engineering (6 questions): Techniques, insider threats, impersonation on social networking sites, identity theft, and countermeasures.
Denial-of-Service (6 questions): DoS and DDoS concepts, botnets, attack techniques, countermeasures, and protection tools.
Session Hijacking (6 questions): Application-level and network-level hijacking, tools, and countermeasures.
Evading IDS, Firewalls, and Honeypots (6 questions): How these defenses work, evasion techniques, evasion tools, detecting honeypots, and countermeasures.

Core Concept 1: Sniffing

Sniffing means capturing traffic as it crosses the network. On a hub, every device sees every frame, so passive sniffing works. On a switch, an attacker has to use active sniffing to trick the switch or hosts into sending traffic their way.

MAC flooding: The attacker fills the switch’s content addressable memory (CAM) table with fake MAC addresses. Once the table is full, many switches fall back to flooding frames out every port, acting like a hub. Tools like macof do this. Defense: Port security that limits MAC addresses per port.
DHCP starvation and rogue DHCP servers: The attacker exhausts the DHCP pool, then answers clients from a rogue server that hands out the attacker’s address as the default gateway or DNS server. Defense: DHCP snooping, which only trusts DHCP replies on designated ports.
ARP poisoning: The attacker sends forged ARP replies so victims map the gateway’s IP address to the attacker’s MAC address, creating a man-in-the-middle position. Defense: Dynamic ARP Inspection (DAI), which relies on the DHCP snooping binding table, and static ARP entries for critical hosts.
DNS poisoning: Corrupting DNS caches or responses to redirect victims to a malicious site. Defense: DNSSEC and hardened resolvers.
Detecting sniffers: A sniffing host usually has its network interface in promiscuous mode. Detection methods include the ping and ARP methods, which send packets with a wrong MAC address that only a promiscuous host will answer, and Nmap’s sniffer-detect script.

Core Concept 2: Social Engineering

Social engineering targets people rather than systems. Know these terms precisely, because the distractors swap them:

Phishing is broad and untargeted. Spear phishing targets a specific person or group. Whaling targets senior executives. Vishing uses voice calls, and smishing uses text messages.
Pretexting uses an invented scenario, such as posing as IT support, to get information.
Baiting leaves something tempting, such as an infected USB drive, for a victim to use.
Tailgating means following an authorized person through a secure door without their knowledge. Piggybacking means the authorized person knowingly lets you in.
Insider threats include malicious, negligent, and compromised insiders.

Key countermeasure: Security awareness training is the most common best answer, backed by policies, verification procedures, and physical controls like mantraps.

Core Concept 3: Denial-of-Service

DoS attacks target availability. EC-Council groups them into three broad categories:

Volumetric attacks consume bandwidth, such as UDP floods and amplification attacks that abuse DNS or NTP to send large responses to a spoofed victim address.
Protocol attacks exhaust connection state or device resources. A SYN flood sends many SYN packets and never completes the three-way handshake, filling the target’s connection table. Others include the ping of death, Smurf attacks, and fragmentation attacks.
Application-layer attacks send requests that look legitimate, such as HTTP GET or POST floods, or a Slowloris attack that keeps many connections open with partial requests.

A botnet is a network of compromised hosts (bots or zombies) controlled through a command-and-control (C2) server, and it’s the usual engine behind DDoS attacks. Countermeasures include SYN cookies, rate limiting, ingress and egress filtering, blackholing or sinkholing traffic, and DDoS protection services.

Core Concept 4: Session Hijacking

Session hijacking takes over an established, authenticated session.

Network-level hijacking targets the TCP or UDP session itself. TCP hijacking requires predicting or observing sequence numbers so injected packets are accepted. In blind hijacking, the attacker can’t see the responses.
Application-level hijacking steals or forges the session token, often a cookie. Methods include sniffing, cross-site scripting (XSS), session fixation (forcing a victim to use a session ID the attacker already knows), and man-in-the-browser attacks.
Countermeasures: Use HTTPS everywhere, generate long random session IDs, regenerate the session ID after login, set the Secure and HttpOnly cookie flags, and enforce session timeouts.

Core Concept 5: Evading IDS, Firewalls, and Honeypots

This topic tests both how defenses work and how attackers slip past them.

IDS types: Signature-based detection matches known patterns. Anomaly-based detection flags deviations from a baseline. Know the alert outcomes: a false positive is an alert on harmless traffic, and a false negative is a missed attack, the more dangerous of the two.
Firewall types: Packet filtering (Layer 3), circuit-level gateways (session layer), application-level proxies (Layer 7), stateful inspection firewalls, and next-generation firewalls.
IDS evasion: Fragmentation, obfuscation and encoding, encryption, flooding the IDS with noise, and insertion and evasion attacks. In an insertion attack, the IDS accepts a packet that the end host rejects. In an evasion attack, the end host accepts a packet that the IDS rejects.
Firewall evasion: Firewalking to map rules, IP address spoofing, source routing, tunneling traffic inside allowed protocols such as HTTP, DNS, or ICMP, and Nmap options like fragmentation (-f), decoys (-D), and a spoofed source port (–source-port). An ACK scan (-sA) helps tell filtered ports from unfiltered ones.
Honeypots: Low-interaction honeypots emulate limited services. High-interaction honeypots run real systems and capture more attacker behavior. Attackers try to detect honeypots by looking for oddly limited services or unusual response timing.

Common Network and Perimeter Hacking Traps

Mixing up the Layer 2 defenses: Port security stops MAC flooding, DHCP snooping stops rogue DHCP, and Dynamic ARP Inspection stops ARP poisoning. Questions often list all three as options.
Reversing insertion and evasion: Ask “who accepts the packet?” If the IDS accepts and the host drops it, that’s insertion.
Calling every flood a volumetric attack: A SYN flood exhausts connection state, so it’s a protocol attack, even though it involves many packets.
Confusing tailgating and piggybacking: The difference is whether the authorized person consents.
Picking a technical fix for a people problem: For social engineering, training and verification procedures usually beat a new firewall rule.
Treating encryption as a cure-all: HTTPS protects tokens in transit, but it doesn’t stop session fixation or XSS-based cookie theft on its own.

Sample Network and Perimeter Hacking Scenarios

Scenario 1: The Switch That Acts Like a Hub

Consider a scenario where a security analyst notices that a workstation running a packet capture suddenly sees traffic between other hosts on the same switch. The switch logs show thousands of new MAC addresses learned on a single access port in a few seconds. Which control would best prevent this?

The flood of MAC addresses on one port points to MAC flooding. Once the CAM table fills, the switch floods frames out every port, so the attacker can sniff traffic meant for others. Dynamic ARP Inspection and DHCP snooping are tempting because they’re also Layer 2 defenses, but they address different attacks.

The best answer is port security configured to limit the number of MAC addresses allowed on each port.

Scenario 2: The Packet the IDS Saw Differently

Now consider a question where an attacker sends a crafted packet with a TTL set so that it reaches the network IDS but expires before reaching the target server. The IDS processes the packet and reassembles the stream differently from the server, so the attack signature never matches. What type of technique is this?

The key question is who accepted the packet. The IDS processed it, but the end host never received it. That’s an insertion attack, which lets an attacker slip junk data into the IDS’s view of the stream and hide the real signature. “Evasion attack” is the trap answer because it’s the reverse situation, where the host accepts a packet the IDS drops.

How Network and Perimeter Hacking Connects to Other Domains

Reconnaissance Techniques: Scanning beyond IDS and firewalls appears in Domain 2, and the same Nmap evasion options come back here.
System Hacking Phases and Attack Techniques: Botnets are built from malware, and sniffed credentials feed password attacks and privilege escalation.
Web Application Hacking: Application-level session hijacking overlaps with XSS and session management flaws.
Wireless Network Hacking: Evil twins and rogue access points are wireless versions of man-in-the-middle attacks.
Cryptography: TLS, certificates, and secure protocols are core countermeasures to sniffing and hijacking.

A Focused Study Plan for Network and Perimeter Hacking

Build an attack-defense table. For each of the five topics, list each attack, its symptom, a common tool, and its primary countermeasure.
Watch the attacks happen. In a lab you own, capture traffic with Wireshark and watch ARP, DHCP, and the TCP handshake. Seeing normal traffic makes the attacks easier to picture.
Drill the look-alikes. Spend dedicated time on pairs that get confused: insertion vs. evasion, tailgating vs. piggybacking, and low- vs. high-interaction honeypots.
Practice by topic, then mix. Use Pocket Prep’s Build Your Own Quiz to focus on Network and Perimeter Hacking, then review every miss with a Missed Questions quiz. Once your scores climb, switch to mixed Timed Quiz sets so these questions show up alongside the other domains, just like on exam day.

Start Preparing for the CEH Exam With Pocket Prep

Thirty questions is a big slice of the CEH, and every scenario you work through makes the next one easier to spot. Pocket Prep’s EC-Council CEH practice questions include 1,600 questions with detailed explanations that walk through why each attack and countermeasure fits. Use the Weakest Subject quiz to find your next focus, and keep going. You’ve got this!