GAQM CPEH-001 Exam - Topic 3 Question 100 Discussion

Actual exam question for GAQM's CPEH-001 exam

Question #: 100
Topic #: 3

Most NIDS systems operate in layer 2 of the OSI model. These systems feed raw traffic into a detection engine and rely on the pattern matching and/or statistical analysis to determine what is malicious. Packets are not processed by the host's TCP/IP stack allowing the NIDS to analyze traffic the host would otherwise discard. Which of the following tools allows an attacker to intentionally craft packets to confuse pattern-matching NIDS systems, while still being correctly assembled by the host TCP/IP stack to render the attack payload?

ADefrag

BTcpfrag

CTcpdump

DFragroute

Show Suggested Answer

Suggested Answer: D

fragroute intercepts, modifies, and rewrites egress traffic destined for a specified host, implementing most of the attacks described in the Secure Networks 'Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection' paper of January 1998. It features a simple ruleset language to delay, duplicate, drop, fragment, overlap, print, reorder, segment, source-route, or otherwise monkey with all outbound packets destined for a target host, with minimal support for randomized or probabilistic behaviour. This tool was written in good faith to aid in the testing of network intrusion detection systems, firewalls, and basic TCP/IP stack behaviour.

by Casandra at Sep 15, 2024, 06:15 AM

Limited Time Offer

25%

Off

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Mozell

5 months ago

Just a heads up, not all NIDS will fall for these tricks!

upvoted 0 times

...

Mitsue

6 months ago

Yeah, Fragroute is solid, but Tcpdump is just for capturing, right?

upvoted 0 times

...

Lashandra

6 months ago

Wait, are we sure about that? I thought Tcpfrag was more effective.

upvoted 0 times

...

Tenesha

6 months ago

Definitely, it can confuse NIDS pretty well!

upvoted 0 times

...

Lucy

6 months ago

I've heard Fragroute is the go-to for this kind of packet manipulation.

upvoted 0 times

...

Britt

7 months ago

I’m leaning towards Defrag, but I recall that Tcpdump is more for capturing traffic rather than crafting it.

upvoted 0 times

...

Patria

7 months ago

Fragroute sounds familiar; I feel like it was mentioned in a practice question about evading NIDS.

upvoted 0 times

...

Graciela

7 months ago

I think Tcpfrag might be the right answer since it deals with fragmenting packets, but I could be mixing it up with something else.

upvoted 0 times

...

Lai

7 months ago

I remember studying about how NIDS works, but I'm not entirely sure which tool specifically crafts packets to bypass them.

upvoted 0 times

...

Asha

7 months ago

This question is testing our understanding of NIDS architecture and how an attacker can bypass detection. Fragroute seems like the most likely answer based on the description.

upvoted 0 times

...

Aja

7 months ago

I'm not entirely sure about this one. I'll need to carefully consider the differences between the tools mentioned and how they might impact NIDS evasion.

upvoted 0 times

...

Sang

7 months ago

Hmm, I'm a bit confused by the technical details here. I'll need to review my notes on NIDS and packet processing to make sure I understand the key points.

upvoted 0 times

...

Sherron

7 months ago

This seems like a tricky question. I'll need to think carefully about the concepts of layer 2, pattern matching, and how an attacker could bypass a NIDS.

upvoted 0 times

...

Jillian

7 months ago

Aha, I think I know the answer to this one. Fragroute is a tool that can intentionally fragment packets in a way that confuses pattern-matching NIDS, while still allowing the host to reassemble them correctly.

upvoted 0 times

...

Zona

7 months ago

Hmm, I'm a bit unsure about this. I know data normalization is important for data quality, but I'm not sure if that's the right answer here.

upvoted 0 times

...

Olive

2 years ago

Hmm, D) Fragroute looks like the winner to me. I wonder if the exam question will include a joke about how the attacker can 'fragment' their way to victory.

upvoted 0 times

Sabra

2 years ago

Definitely, it's important to be aware of these tactics to protect against cyber attacks.

upvoted 0 times

...

Shawnta

2 years ago

It's interesting how attackers can use tools like Fragroute to bypass security measures.

upvoted 0 times

...

Emiko

2 years ago

Yeah, Fragroute is designed to confuse pattern-matching NIDS systems.

upvoted 0 times

...

Shenika

2 years ago

I think D) Fragroute is the correct answer.

upvoted 0 times

...

Lashaunda

2 years ago

D) Fragroute seems like the right choice here. It's designed to bypass NIDS detection by fragmenting packets in a way that confuses the pattern matching.

upvoted 0 times

Kristin

1 year ago

D) Fragroute seems like the right choice here. It's designed to bypass NIDS detection by fragmenting packets in a way that confuses the pattern matching.

upvoted 0 times

...

Dexter

2 years ago

D) Fragroute

upvoted 0 times

...

Bok

2 years ago

C) Tcpdump

upvoted 0 times

...

Arletta

2 years ago

B) Tcpfrag

upvoted 0 times

...

Cory

2 years ago

A) Defrag

upvoted 0 times

...

Emmanuel

2 years ago

I'm not sure, but I think Meaghan's reasoning makes sense. Fragroute could indeed confuse pattern-matching NIDS systems.

upvoted 0 times

...

Reita

2 years ago

I think the answer is D) Fragroute. It allows an attacker to craft packets that can confuse pattern-matching NIDS systems while still being properly assembled by the host TCP/IP stack.

upvoted 0 times