Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GAQM CPEH-001 Exam - Topic 4 Question 103 Discussion

A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
C) All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
D) 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0

GAQM CPEH-001 Exam - Topic 4 Question 103 Discussion

Actual exam question for GAQM's CPEH-001 exam
Question #: 103
Topic #: 4
[All CPEH-001 Questions]

A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?

Show Suggested Answer Hide Answer
Suggested Answer: B

Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker's host to a destination host through a packet-filtering device. This technique can be used to map 'open' or 'pass through' ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.


by Rosina at Nov 15, 2024, 10:36 AM

Limited Time Offer

25%

Off

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Cherry
9 months ago
All from the same LAN? Nah, that doesn't add up.
upvoted 0 times
...
Talia
9 months ago
Wait, how can 13 packets have ID 0? Seems sketchy.
upvoted 0 times
...
Ceola
10 months ago
I think it's more likely a worm, too many sources.
upvoted 0 times
...
Kattie
10 months ago
Definitely looks like a tool was used for those IDs.
upvoted 0 times
...
Paola
10 months ago
That's a lot of packets in a short time!
upvoted 0 times
...
Julieta
10 months ago
The mention of ICMP ID 0 and Seq 0 makes me think those packets could be from a NAT environment, but I wonder if that's too much of a leap without more context.
upvoted 0 times
...
Lorita
10 months ago
It seems plausible that all 77 packets could come from the same LAN segment, but I feel like that might be too simplistic given the number of different sources involved.
upvoted 0 times
...
Lemuel
11 months ago
I remember a practice question about ICMP packets, and it mentioned that a lot of identical IDs could indicate a possible attack or spoofing, but I'm not confident about the specifics here.
upvoted 0 times
...
Darnell
11 months ago
I'm not entirely sure, but I think the ICMP ID and Seq numbers being the same for 77 packets might suggest they were generated by a tool rather than a normal OS behavior.
upvoted 0 times
...
Carlton
11 months ago
This looks like it could be a network security scenario. I'm going to focus on analyzing the packet information and considering the potential implications.
upvoted 0 times
...
Pearline
11 months ago
I'm a bit confused by the different ICMP ID and Seq numbers. I'll need to think through how those might relate to the other details provided.
upvoted 0 times
...
Sherly
11 months ago
The ICMP ID and Seq numbers seem like they could be a clue. I'm leaning towards option B, but I want to double-check my reasoning.
upvoted 0 times
...
Aleisha
11 months ago
Okay, let's break this down. The key information is the ICMP ID and Sequence numbers, as well as the number of packets and sites. I think I have a strategy to approach this.
upvoted 0 times
...
Adela
11 months ago
This question seems straightforward, but I want to make sure I understand the details before answering.
upvoted 0 times
...
Almeta
1 year ago
Option C seems reasonable, but I'm not sure if all 77 packets necessarily came from the same LAN. Could be a coordinated attack from multiple segments.
upvoted 0 times
Maddie
1 year ago
C) All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
upvoted 0 times
...
Lorean
1 year ago
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
upvoted 0 times
...
Chanel
1 year ago
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
upvoted 0 times
...
...
Tijuana
1 year ago
Haha, I bet the person who wrote this question is a real ICMP_ECHO fanatic. Gotta love those packet IDs and sequences!
upvoted 0 times
Louis
1 year ago
C) All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
upvoted 0 times
...
Judy
1 year ago
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
upvoted 0 times
...
Kip
1 year ago
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
upvoted 0 times
...
...
Colby
1 year ago
I'm leaning towards A. 47 different sites sending spoofed packets sounds like a worm to me.
upvoted 0 times
Bernardine
1 year ago
D) 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0
upvoted 0 times
...
Cristen
1 year ago
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
upvoted 0 times
...
Bobbye
1 year ago
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
upvoted 0 times
...
...
Nilsa
1 year ago
I'm going with D. The packets with ICMP ID 0 and Seq 0 are probably from behind a NAT, which makes sense for an external network.
upvoted 0 times
Rolland
1 year ago
I'm leaning towards C. All 77 packets having the same ID and Seq could mean they came from the same LAN segment.
upvoted 0 times
...
Jamal
1 year ago
D makes sense to me too. The packets with ID 0 and Seq 0 are likely from behind a NAT.
upvoted 0 times
...
Alysa
1 year ago
I agree with A. It's possible that the packets were sent by a worm spoofing IP addresses.
upvoted 0 times
...
Terrilyn
1 year ago
I think B is more likely. The ID and Seq numbers seem to be set by a tool, not the OS.
upvoted 0 times
...
...
Louvenia
1 year ago
Hmm, I think the answer is B. The ICMP ID and Seq numbers seem too precise to be set by an operating system. This is likely the work of a tool.
upvoted 0 times
Jovita
1 year ago
User2: Definitely, it's more likely that a tool set those numbers rather than the operating system.
upvoted 0 times
...
Lilli
1 year ago
User1: I agree, the precision of the ICMP ID and Seq numbers does seem suspicious.
upvoted 0 times
...
...
Edwin
1 year ago
I agree with option D, as the 13 packets with ICMP ID 0 and Seq 0 were probably from an external network behind a NAT.
upvoted 0 times
...
Thora
1 year ago
I believe the ICMP ID and Seq numbers were most likely set by a tool and not by the operating system.
upvoted 0 times
...
Jacinta
1 year ago
I think the packets were sent by a worm spoofing the IP addresses of infected sites.
upvoted 0 times
...

Save Cancel