MENU
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?
Suggested Answer: B
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker's host to a destination host through a packet-filtering device. This technique can be used to map 'open' or 'pass through' ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.
37 comments · newest first
CH
Cherry
11 months ago
All from the same LAN? Nah, that doesn't add up.
TA
Talia
11 months ago
Wait, how can 13 packets have ID 0? Seems sketchy.
CE
Ceola
11 months ago
I think it's more likely a worm, too many sources.
KA
Kattie
12 months ago
Definitely looks like a tool was used for those IDs.
PA
Paola
12 months ago
That's a lot of packets in a short time!
JU
Julieta
12 months ago
The mention of ICMP ID 0 and Seq 0 makes me think those packets could be from a NAT environment, but I wonder if that's too much of a leap without more context.
LO
Lorita
1 year ago
It seems plausible that all 77 packets could come from the same LAN segment, but I feel like that might be too simplistic given the number of different sources involved.
LE
Lemuel
1 year ago
I remember a practice question about ICMP packets, and it mentioned that a lot of identical IDs could indicate a possible attack or spoofing, but I'm not confident about the specifics here.
DA
Darnell
1 year ago
I'm not entirely sure, but I think the ICMP ID and Seq numbers being the same for 77 packets might suggest they were generated by a tool rather than a normal OS behavior.
CA
Carlton
1 year ago
This looks like it could be a network security scenario. I'm going to focus on analyzing the packet information and considering the potential implications.
PE
Pearline
1 year ago
I'm a bit confused by the different ICMP ID and Seq numbers. I'll need to think through how those might relate to the other details provided.
SH
Sherly
1 year ago
The ICMP ID and Seq numbers seem like they could be a clue. I'm leaning towards option B, but I want to double-check my reasoning.
AL
Aleisha
1 year ago
Okay, let's break this down. The key information is the ICMP ID and Sequence numbers, as well as the number of packets and sites. I think I have a strategy to approach this.
AD
Adela
1 year ago
This question seems straightforward, but I want to make sure I understand the details before answering.
AL
Almeta
1 year ago
Option C seems reasonable, but I'm not sure if all 77 packets necessarily came from the same LAN. Could be a coordinated attack from multiple segments.
MA
Maddie
1 year ago
C) All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
LO
Lorean
1 year ago
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
CH
Chanel
1 year ago
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
TI
Tijuana
1 year ago
Haha, I bet the person who wrote this question is a real ICMP_ECHO fanatic. Gotta love those packet IDs and sequences!
LO
Louis
1 year ago
C) All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
JU
Judy
1 year ago
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
KI
Kip
1 year ago
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
CO
Colby
1 year ago
I'm leaning towards A. 47 different sites sending spoofed packets sounds like a worm to me.
BE
Bernardine
1 year ago
D) 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0
CR
Cristen
1 year ago
B) ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
BO
Bobbye
1 year ago
A) The packets were sent by a worm spoofing the IP addresses of 47 infected sites
NI
Nilsa
2 years ago
I'm going with D. The packets with ICMP ID 0 and Seq 0 are probably from behind a NAT, which makes sense for an external network.
RO
Rolland
1 year ago
I'm leaning towards C. All 77 packets having the same ID and Seq could mean they came from the same LAN segment.
JA
Jamal
1 year ago
D makes sense to me too. The packets with ID 0 and Seq 0 are likely from behind a NAT.
AL
Alysa
1 year ago
I agree with A. It's possible that the packets were sent by a worm spoofing IP addresses.
TE
Terrilyn
1 year ago
I think B is more likely. The ID and Seq numbers seem to be set by a tool, not the OS.
LO
Louvenia
2 years ago
Hmm, I think the answer is B. The ICMP ID and Seq numbers seem too precise to be set by an operating system. This is likely the work of a tool.
JO
Jovita
1 year ago
User2: Definitely, it's more likely that a tool set those numbers rather than the operating system.
LI
Lilli
1 year ago
User1: I agree, the precision of the ICMP ID and Seq numbers does seem suspicious.
ED
Edwin
2 years ago
I agree with option D, as the 13 packets with ICMP ID 0 and Seq 0 were probably from an external network behind a NAT.
TH
Thora
2 years ago
I believe the ICMP ID and Seq numbers were most likely set by a tool and not by the operating system.
JA
Jacinta
2 years ago
I think the packets were sent by a worm spoofing the IP addresses of infected sites.