Which of the following filters can be used by a network defender to detect TCP ping sweep attempts?
A. udp.dstport==7
B. tcp.dstport==7
C. tcp.flags==012
D. tcp.flags==0x00
Answer (2)
The most relevant option for detecting TCP ping sweep attempts is B. tcp.dstport==7 , as it pertains to monitoring TCP traffic directed to a specific port. Options A, C, and D do not effectively target TCP ping sweep detection. Understanding the nature of TCP packets and monitoring ports can help in detecting such activities.
;
TCP ping sweep is a technique used to determine which hosts on a network are active. This is done by sending specialized packets to multiple hosts and analyzing their responses. Network defenders can use packet filtering and monitoring tools to detect such activities by observing specific patterns in the packet traffic.
Let's consider the options given, which provide filters that can help identify these activities:
Option A: udp.dstport==7
This option looks for UDP packets targeted at port 7. The ping sweep technique typically uses ICMP or TCP protocols rather than UDP, so this filter is not relevant for detecting TCP ping sweep attempts.
Option B: tcp.dstport==7
This filter checks for TCP packets aimed at port 7. In some cases, the Echo protocol (port 7) can be used over TCP for troubleshooting purposes that resemble a ping sweep. Although it’s less common for sweep attempts, it might be used in specific scenarios.
Option C: tcp.flags==012
This filter would be used to identify TCP packets with particular flag settings. However, the flag '012' does not represent a valid combination relevant to detecting ping sweeps, which typically involve SYN packets.
Option D: tcp.flags==0x00
The 'tcp.flags==0x00' filter identifies TCP packets with no flags set, commonly known as ‘NULL scans’ in certain network scanning techniques. Though NULL scans are slightly different from ping sweeps, they can still indicate scanning behavior when used for reconnaissance.
Therefore, Option B: tcp.dstport==7 is the most relevant for detecting TCP ping sweep attempts because it involves listening to Port 7 (echo), which can be used with TCP for sweeping purposes.
