Discuss EC-Council 312-38 Exam Topic 1 Question 115

Which of the following filters can be used to detect UDP scan attempts using Wireshark?

Aicmp.type==3 and icmp.code==3

Bicmp.type==13

Cicmp.type==8 or icmp.type==0

Dicmp.type==15

Suggested Answer: A

The correct filter to detect UDP scan attempts using Wireshark is not listed among the options provided. To detect UDP scan attempts, a Wireshark filter that targets UDP traffic specifically would be used, rather than an ICMP type and code filter. A common method to detect a UDP scan is to look for a large amount of UDP packets sent to different ports, which can be indicative of a scanning activity. The filter would typically include parameters that isolate UDP traffic, such asudp.portorudp.dstportcombined with a range or list of ports.

Get Premium 312-38 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Tess 6 months ago

D is less useful. It’s for information requests, not scans.

Yuki 6 months ago

C is more relevant. It captures echo requests, which can indicate scans.

Jeanice 6 months ago

I disagree, A seems too specific. What about B? It detects timestamp requests.

Jeanice 6 months ago

I think option A is the best choice. It shows unreachable ports.

Theresia 6 months ago

C) is just for ping, not UDP scans!

Daniel 7 months ago

Wait, are we sure about A)? Seems too simple.

Herminia 7 months ago

Definitely A), no doubt about it!

Tammy 7 months ago

I thought B) was for timestamp requests?

Willard 7 months ago

A) is correct for detecting unreachable ports.

Valentine 7 months ago

Lol, this question is a real head-scratcher. I'm just going to go with A and hope for the best.

Barrett 7 months ago

Wait, why would we use ICMP to detect a UDP scan? Shouldn't we be looking for UDP packets instead?

Nicolette 8 months ago

Haha, I bet the exam writer is trying to trick us with these options. A is the only logical choice here.

Lynette 8 months ago

I think option C is the way to go. ICMP type 8 and 0 should catch the UDP scans.

Louann 8 months ago

The correct answer is A. ICMP type 3 code 3 is the way to detect UDP scan attempts.

Yolande 9 months ago

I thought ICMP type 8 and 0 were for echo requests and replies, so they probably wouldn't help with UDP scans, right?

Felix 9 months ago

I practiced a question similar to this, and I feel like A is definitely the most relevant option for detecting UDP scans.

Suzan 9 months ago

I'm not entirely sure, but I remember something about ICMP type 3 indicating unreachable errors, which could relate to UDP scans.

Jamika 9 months ago

I think UDP scans might show up as ICMP unreachable messages, so maybe A is the right choice?

Lilli 9 months ago

B seems like the best option, but I want to double-check the ICMP message types to be sure.

Bobbye 10 months ago

I'm a bit confused on the difference between UDP scans and other types of scans. I'll need to review that before answering.

Dona 10 months ago

C looks promising, since ICMP echo request/reply could be used to detect some types of scans.

Ruthann 10 months ago

Hmm, I'm not sure about this one. I'll need to think through the ICMP message types more carefully.

Rene 10 months ago

I think the answer is B, since UDP scans would trigger ICMP port unreachable messages.

Louisa 4 months ago

↳ replying to Rene

I thought about A too, but B is more relevant for UDP.

Rhea 4 months ago

↳ replying to Rene

Yeah, B makes sense. ICMP port unreachable is key.

Goldie 6 months ago

↳ replying to Rene

I agree, B seems right. UDP scans trigger those messages.

EC-Council 312-38 Exam - Topic 1 Question 115 Discussion