QuestionQ58

Logs and Network Forensics

Mason, a network forensics expert, is investigating a recent security incident on an organization’s server. While examining network traffic, Mason suspects that the server is being targeted by a denial-of-service attack. To investigate the traffic patterns further, Mason uses Wireshark and applies the filter tcp.flags==0X003 to identify unusual traffic behavior. Which of the following results does Mason expect from this Wireshark filter?

  • A Detect packets moving without flags
  • B Detect a SYN/FIN flooding attempt
  • C Detect RST packets
  • D Detect SYN packets
Explanation

TCP flag value 0x003 combines FIN (0x001) and SYN (0x002). Filtering for that value identifies TCP packets with both SYN and FIN set, which is indicative of a SYN/FIN flooding attempt.

Community Discussion

No comments yet. Be the first to start the discussion!