MENU
Network Intrusion Detection systems can monitor traffic in real time on networks. Which one of the following techniques can be very effective at avoiding proper detection?
Suggested Answer: A
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
If the default fragmentation reassembly timeout is set to higher on the client than on the IDS then the it is possible to send an attack in fragments that will never be reassembled in the IDS but they will be reassembled and read on the client computer acting victim.
11 comments · newest first
VE
Veronica
12 months ago
UDP is often overlooked, but it can be tricky for detection too.
LE
Lettie
12 months ago
Wait, can fragmented ICMP traffic really bypass detection? Sounds fishy.
CH
Chi
1 year ago
I think using only TCP protocols is safer, right?
YO
Yolando
1 year ago
Totally agree, it's a classic evasion technique!
FE
Felice
1 year ago
Fragmentation of packets can really throw off detection systems.
AN
Annett
1 year ago
I vaguely remember that TCP and UDP have different behaviors in terms of detection, but I can't recall which one is more effective at avoiding detection.
MO
Monte
1 year ago
I'm leaning towards option D, but I feel like I need to double-check how ICMP traffic is treated by intrusion detection systems.
KA
Kara
1 year ago
I think we practiced a question similar to this, and I recall that using fragmented packets can confuse IDS systems.
VE
Venita
1 year ago
I remember studying how packet fragmentation can help evade detection, but I'm not entirely sure if it's the best method.
CH
Cherilyn
1 year ago
Okay, let me see... sum, addtotals, count, avg. Addtotals doesn't sound like a standard stats function, so I'll go with that one.
SO
Sophia
1 year ago
Okay, I've got this. Type 10 opaque LSAs are used for traffic engineering, and they're flooded to all areas. I'm pretty confident in that.