QuestionQ24

Forensics Techniques

Question Image

Refer to the exhibit. What should an engineer conclude from this Wireshark capture of suspicious network traffic?

  • A There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections.
  • B There are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure.
  • C There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure.
  • D There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure.
Explanation

A high volume of TCP SYN packets from numerous apparent source addresses directed at one host's HTTP port indicates a SYN flood attempt. Increasing the connection backlog and expiring or recycling old half-open TCP connections helps reduce exhaustion of the server's TCP connection queue.

Community Discussion

No comments yet. Be the first to start the discussion!