Eccouncil 312-38 Exam - Topic 9 Question 109 Discussion

Actual exam question for Eccouncil's 312-38 exam

Question #: 109
Topic #: 9

A network administrator is monitoring the network traffic with Wireshark. Which of the following filters will she use to view the packets moving without setting a flag to detect TCP Null Scan attempts?

ATCRflags==0x000

BTcp.flags==0X029

CTcp.dstport==7

DTcp.flags==0x003

Show Suggested Answer

Suggested Answer: A

In Wireshark, to detect TCP Null Scan attempts, the filter used istcp.flags==0. This filter will show packets where no TCP flags are set, which is indicative of a TCP Null Scan. A TCP Null Scan is a type of network reconnaissance technique where the attacker sends TCP packets with no flags set to the target system. If the target system responds with a RST packet, it indicates that the port is closed, while no response suggests that the port is open or filtered. This method is used because some systems do not log these null packets, allowing the scan to go unnoticed.

by Jacklyn at Jul 14, 2025, 03:07 AM

Limited Time Offer

25%

Off

Get Premium 312-38 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Andra

9 months ago

Wait, why would anyone use a Null Scan? Sounds sketchy!

upvoted 0 times

...

Refugia

9 months ago

Totally agree, A is the way to go!

upvoted 0 times

...

Nettie

9 months ago

I thought B was correct for some reason.

upvoted 0 times

...

Slyvia

9 months ago

C is just for echo requests, not related to flags.

upvoted 0 times

...

Corinne

9 months ago

A is the right filter for TCP Null Scan.

upvoted 0 times

...

Ronnie

10 months ago

I vaguely recall that TCP flags can be tricky; I might lean towards option B since it has a specific flag value, but I'm not confident.

upvoted 0 times

...

Marguerita

10 months ago

I thought the Null Scan was when no flags are set, so option A seems like the right choice, but I could be mixing it up with another question.

upvoted 0 times

...

Loren

10 months ago

I remember practicing with Wireshark filters, and I feel like option D might be relevant since it involves TCP flags, but I'm not entirely sure.

upvoted 0 times

...

Remona

10 months ago

I think the filter for detecting TCP Null Scan attempts is related to the flags being set to zero, so maybe option A?

upvoted 0 times

...

Brandon

10 months ago

Okay, I've got it! The question is asking for a filter to view packets without a TCP Null Scan, so we want to look for packets with no TCP flags set. That means the answer is A, TCRflags==0x000.

upvoted 0 times

...

Casie

11 months ago

I think the key here is to look for packets with no TCP flags set. So option D, tcp.flags==0x003, seems like the right choice since that would match packets with no flags.

upvoted 0 times

...

Vincenza

11 months ago

Hmm, I'm a bit confused on this one. I'm not sure if the flags in the answers refer to the TCP flags or something else. I'll have to think about this one a bit more.

upvoted 0 times

...

Marylyn

11 months ago

I'm pretty sure the answer is A. The question is asking for a filter to view packets without setting a flag, and TCRflags==0x000 should match packets with no flags set.

upvoted 0 times

...

Janna

12 months ago

Wireshark, huh? Bet the network admin is having a blast filtering through all those packets. Reminds me of the time I had to debug a router issue... talk about a needle in a haystack!

upvoted 0 times