GAQM Exam CPEH-001 Topic 4 Question 103 Discussion

Actual exam question for GAQM's CPEH-001 exam

Question #: 103
Topic #: 4

A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?

AThe packets were sent by a worm spoofing the IP addresses of 47 infected sites

BICMP ID and Seq numbers were most likely set by a tool and not by the operating system

CAll 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number

D13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0

Show Suggested Answer

Suggested Answer: B

Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker's host to a destination host through a packet-filtering device. This technique can be used to map 'open' or 'pass through' ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.

by Rosina at Nov 15, 2024, 10:36 AM

Limited Time Offer

25%

Off

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Almeta

1 months ago

Option C seems reasonable, but I'm not sure if all 77 packets necessarily came from the same LAN. Could be a coordinated attack from multiple segments.

upvoted 0 times

...

1 months ago

I'm leaning towards A. 47 different sites sending spoofed packets sounds like a worm to me.

upvoted 0 times

Bernardine

14 days ago

D) 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0

upvoted 0 times

...

Cristen

1 months ago

B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system

upvoted 0 times

...

Bobbye

1 months ago

A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites

upvoted 0 times

...

2 months ago

Hmm, I think the answer is B. The ICMP ID and Seq numbers seem too precise to be set by an operating system. This is likely the work of a tool.

upvoted 0 times

Jovita

23 days ago

User2: Definitely, it's more likely that a tool set those numbers rather than the operating system.

upvoted 0 times

...

Lilli

1 months ago

User1: I agree, the precision of the ICMP ID and Seq numbers does seem suspicious.

upvoted 0 times

...

Edwin

2 months ago

I agree with option D, as the 13 packets with ICMP ID 0 and Seq 0 were probably from an external network behind a NAT.

upvoted 0 times

...

Thora

2 months ago

I believe the ICMP ID and Seq numbers were most likely set by a tool and not by the operating system.

upvoted 0 times

...

Jacinta

2 months ago

I think the packets were sent by a worm spoofing the IP addresses of infected sites.

upvoted 0 times

...