MENU
A network administrator is monitoring the network traffic with Wireshark. Which of the following filters will she use to view the packets moving without setting a flag to detect TCP Null Scan attempts?
Suggested Answer: A
Get Premium 312-38 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
In Wireshark, to detect TCP Null Scan attempts, the filter used istcp.flags==0. This filter will show packets where no TCP flags are set, which is indicative of a TCP Null Scan. A TCP Null Scan is a type of network reconnaissance technique where the attacker sends TCP packets with no flags set to the target system. If the target system responds with a RST packet, it indicates that the port is closed, while no response suggests that the port is open or filtered. This method is used because some systems do not log these null packets, allowing the scan to go unnoticed.
33 comments · newest first
AN
Andra
10 months ago
Wait, why would anyone use a Null Scan? Sounds sketchy!
RE
Refugia
10 months ago
Totally agree, A is the way to go!
NE
Nettie
11 months ago
I thought B was correct for some reason.
SL
Slyvia
11 months ago
C is just for echo requests, not related to flags.
CO
Corinne
11 months ago
A is the right filter for TCP Null Scan.
RO
Ronnie
11 months ago
I vaguely recall that TCP flags can be tricky; I might lean towards option B since it has a specific flag value, but I'm not confident.
MA
Marguerita
12 months ago
I thought the Null Scan was when no flags are set, so option A seems like the right choice, but I could be mixing it up with another question.
LO
Loren
12 months ago
I remember practicing with Wireshark filters, and I feel like option D might be relevant since it involves TCP flags, but I'm not entirely sure.
RE
Remona
12 months ago
I think the filter for detecting TCP Null Scan attempts is related to the flags being set to zero, so maybe option A?
BR
Brandon
1 year ago
Okay, I've got it! The question is asking for a filter to view packets without a TCP Null Scan, so we want to look for packets with no TCP flags set. That means the answer is A, TCRflags==0x000.
CA
Casie
1 year ago
I think the key here is to look for packets with no TCP flags set. So option D, tcp.flags==0x003, seems like the right choice since that would match packets with no flags.
VI
Vincenza
1 year ago
Hmm, I'm a bit confused on this one. I'm not sure if the flags in the answers refer to the TCP flags or something else. I'll have to think about this one a bit more.
MA
Marylyn
1 year ago
I'm pretty sure the answer is A. The question is asking for a filter to view packets without setting a flag, and TCRflags==0x000 should match packets with no flags set.
JA
Janna
1 year ago
Wireshark, huh? Bet the network admin is having a blast filtering through all those packets. Reminds me of the time I had to debug a router issue... talk about a needle in a haystack!
WI
Willie
1 year ago
Yeah, the right filter makes all the difference. What's the go-to?
LA
Lacey
1 year ago
I think Tcp.flags==0x000 is a solid choice for that.
LE
Lenna
1 year ago
For sure! I once spent hours troubleshooting with it.
TH
Thurman
1 year ago
C. Tcp.dstport==7 is a bit too specific, I doubt that's the answer we're looking for.
GE
Gerry
1 year ago
B) Tcp.flags==0X029
ST
Stefania
1 year ago
A) TCRflags==0x000
GE
Germaine
1 year ago
Haha, B. Tcp.flags==0X029 is just a random hex number, that can't be right!
AL
Alberta
1 year ago
Hmm, D. Tcp.flags==0x003 looks good too. Maybe that's the more direct way to check for the flag?
DE
Deeanna
1 year ago
A: I think A) TCRflags==0x000 is the correct filter to use.
CH
Christiane
1 year ago
Well, I remember from my studies that a TCP Null Scan has the flag set to 0x003, so that's why I think D is the correct answer.
BL
Blondell
1 year ago
But why do you think that? Can you explain your rationale?
TE
Telma
1 year ago
I think the answer is A. TCRflags==0x000 since it's specifically mentioned as detecting TCP Null Scan attempts.
MA
Matt
1 year ago
Actually, the correct filter to use is D. Tcp.flags==0x003 to detect TCP Null Scan attempts.
CA
Cathrine
1 year ago
I'm not sure, but I think B. Tcp.flags==0X029 might be the correct filter to use for detecting TCP Null Scan attempts.
SC
Scarlet
1 year ago
No, I believe the correct answer is D. Tcp.flags==0x003 because it is the flag used to detect TCP Null Scan attempts.
GI
Giovanna
1 year ago
I think the answer is A. TCRflags==0x000 since it's specifically mentioned as detecting TCP Null Scan attempts.
TA
Tamar
1 year ago
User1: I think the answer is A. TCRflags==0x000 since it's specifically mentioned as detecting TCP Null Scan attempts.
CH
Christiane
1 year ago
I disagree, I believe the correct answer is D) Tcp.flags==0x003.
BL
Blondell
1 year ago
I think the answer is A) TCRflags==0x000.