QuestionQ606

Detecting Exploitation and Covert Communications Tools

Which of the following is an effective way to detect a covert communication tunnel such as ptunnel?

  • A Rejecting incoming UDP packets with source port < 1024
  • B Capturing outgoing HTTP traffic at unusual times
  • C Restricting ICMP port unreachables with a non-zero payload
  • D Detecting ICMP packets with uncommon payloads
Explanation

ptunnel tunnels network traffic through ICMP packets, so inspection for ICMP traffic with unusual or nonstandard payloads can reveal the covert channel.

Community Discussion

No comments yet. Be the first to start the discussion!