Certified Ethical Hacker (CEH) Practice Question

Ettercap includes built-in modules to launch active ARP poisoning or other man-in-the-middle techniques and, in the same interface, parse and reveal credentials for dozens of clear-text protocols such as FTP, Telnet, POP3, and HTTP. Wireshark and tcpdump are purely passive packet analyzers; they do not generate spoofed ARP traffic and therefore cannot force hosts to send their traffic through the tester's system. Nmap focuses on host discovery, port scanning, and vulnerability enumeration, not packet interception or credential extraction. Therefore, Ettercap is the only choice that meets both requirements in one tool.