Passive sniffing refers to listening to or capturing network traffic without sending any packets or altering the communication stream. The attacker's system operates in "promiscuous mode" to monitor all traffic flowing through the network segment. This technique is mostly used in environments like hub-based or unencrypted Wi-Fi networks, where traffic is visible to all systems.
According to the CEH v13 Official Courseware, Module 08: Sniffing, under the subsection "Passive Sniffing", the following capabilities are associated with passive sniffing:
Capturing unencrypted credentials (usernames and passwords)
Identifying protocols, services, IP addresses, and hostnames
Monitoring HTTP sessions, cookies, and other clear-text traffic
Gathering detailed information for fingerprinting and enumeration
Exporting traffic to PCAPs for forensic and offline analysis
However, passive sniffing does not involve any active interference with the traffic. Therefore, actions like
"modifying and replaying" packets require an attacker to craft and inject packets into the network - this is considered active sniffing or traffic manipulation, which is out of scope for passive techniques.
Thus:
Option A: Valid for passive sniffing (host discovery via captured traffic) Option B: Invalid for passive sniffing (requires active traffic manipulation) Option C: Valid (if data is unencrypted) Option D: Valid (captures traffic for offline review) Reference - CEH v13 Official Courseware:
Module 08: Sniffing
Section: "Passive Sniffing vs Active Sniffing"
Study Guide Pages: Usually found under "Types of Sniffing Techniques"
CEH iLabs/Engage Scenarios: Packet capture and Wireshark lab modules