Posted by: Terr
Any example questions? e.g. "Why is it [not] possible to conduct a spoofing attack on a switched network? Explain."
Doesn't ettercap[-NG] now do spoof attacks on switched networks? Hubbed networks are no problem, but in a switched network you can still use ARP poisoning and MITM to sniff.

Tons more info at ettercap's forum FAQ: http://ettercap.sourceforge.net/forum/viewforum.php?f=8