MENU
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
Suggested Answer: D
Get Premium 212-89 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name 'Xmas' comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filter tcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
39 comments · newest first
AL
Alica
11 months ago
I thought Xmas scans used a different flag altogether!
GE
Gearldine
11 months ago
Option B seems too vague for this.
SH
Sherron
11 months ago
Wait, is it really that specific? Sounds odd.
LO
Louvenia
12 months ago
Definitely agree with that!
JO
Johanna
12 months ago
I think option D is the right filter for TCP Xmas scans.
MA
Marjory
1 year ago
I recall that Xmas scans set multiple flags, so I think option D is the one to go with, but I wish I had reviewed the flag values more thoroughly.
BE
Berry
1 year ago
I practiced a similar question where we had to identify flags for different types of scans. I feel like option B could be relevant, but I'm not confident.
JE
Jerry
1 year ago
I think the correct filter might be related to the TCP flags, possibly option D since it mentions a specific combination that could indicate a Xmas scan.
JE
Jerry
1 year ago
I remember something about TCP Xmas scans involving specific flag combinations, but I'm not entirely sure which filter to use.
TE
Tenesha
1 year ago
This is a good opportunity to demonstrate my knowledge of network security and Wireshark usage. I'm pretty sure the correct answer is option D, which checks for the specific TCP flag combination used in a Xmas scan.
DA
Daron
1 year ago
I'm a little confused by the question. Is a TCP Xmas scan the Pamellae as a TCP SYN scan? I'll need to review my network scanning techniques before I can confidently answer this.
LO
Louann
1 year ago
Okay, let me think this through. A TCP Xmas scan sets the FIN, URG, and PSH flags, so the filter would need to look for that specific combination. I'm going to go with option D.
GR
Gregoria
1 year ago
Hmm, I'm a bit unsure about this one. I know Wireshark can be used to detect network scans, but I'm not sure which specific filter would be used for a TCP Xmas scan.
PA
Pamella
1 year ago
This looks like a pretty straightforward Wireshark filtering question. I think I can handle this one.
EM
Emmett
2 years ago
I'm going with Option A. Who doesn't love a good port 7 scan, am I right? That's the port for the classic 'quote of the day' service, so it's bound to be a winner.
ST
Stacey
2 years ago
Option D is the way to go, no doubt. Rose is gonna have a blast hunting down those pesky Xmas scan attempts with that filter. Just make sure to have some eggnog on hand to celebrate the victory!
RA
Rashida
2 years ago
Hmm, I'm not sure about this one. Wouldn't Option C, the tcp.flags.reset==1 filter, be better for detecting a Xmas scan? Gotta love those tricky TCP flag questions!
GI
Gilberto
2 years ago
I think B is the correct answer. The Xmas scan sets all the TCP flags to 0, so the tcp.flags==0X000 filter should catch that.
AN
Annita
2 years ago
Option D looks like the right answer to me. The Xmas scan sets the FIN, URG, and PSH flags on the TCP packet, which matches the 0x029 hex value.
MA
Marla
2 years ago
That's good to know. Rose can now effectively detect and eliminate any malicious scanning attempts on the network.
SH
Sharen
2 years ago
So, Rose can use the filter tcp.flags==0X029 in Wireshark to detect TCP Xmas scan attempts.
GE
Genevieve
2 years ago
Yes, you are right. The hex value 0x029 matches the flags set in a TCP Xmas scan.
JA
Javier
2 years ago
I think option D is correct because the Xmas scan sets the FIN, URG, and PSH flags on the TCP packet.
OL
Olive
2 years ago
TCP Xmas scan, huh? Sounds like a real holiday headache. Wireshark's the perfect tool to unwrap that mystery. I vote for option D!
LI
Lizette
2 years ago
Gotta love how these hackers try to get all festive with their scans. Option D sounds like the way to go - let's hope Rose can sleigh this one.
JU
Julieta
2 years ago
Let's hope Rose can catch them in the act and stop their malicious activities.
BA
Barabara
2 years ago
Yeah, those hackers sure do get creative with their scanning techniques.
MY
My
2 years ago
I agree, option D looks like the right choice to detect the TCP Xmas scan.
TE
Teri
2 years ago
Haha, Xmas scan? More like 'Bah, humbug' scan! Rose's got her work cut out for her, but with Wireshark, I'm sure she'll deck the halls with the attacker's plans.
AD
Adela
2 years ago
C) tcp.flags.reset==1
SE
Sean
2 years ago
B) tcp.flags==0X000
DU
Dulce
2 years ago
A) tcp.dstport==7
AM
Amie
2 years ago
I'm not sure about the answer. Can someone explain why A) tcp.dstport==7 or D) tcp.flags==0X029 are not correct options?
HY
Hyman
2 years ago
I agree with Letha. C) tcp.flags.reset==1 makes sense as it targets the specific flag used in a TCP Xmas scan.
MO
Moon
2 years ago
The Xmas scan is definitely a crafty one. Let's see, option D looks like it could do the trick. Wireshark knows how to sniff out those pesky scan attempts!
JE
Jeannine
2 years ago
Yes, the Xmas scan is tricky, but with the right Wireshark filter like tcp.flags==0X029, Rose can catch those attackers in the act.
LO
Lonna
2 years ago
I agree, Wireshark is really handy for sniffing out malicious activities. Option D looks like the filter Rose should use.
PA
Pauline
2 years ago
Option D) tcp.flags==0X029 seems like the right choice. Wireshark is a powerful tool for detecting these types of scans.
LE
Letha
2 years ago
I think the answer is C) tcp.flags.reset==1 because it specifically looks for the reset flag set in a TCP Xmas scan.