Discuss GIAC GCED Exam Topic 3 Question 31

A compromised router is reconfigured by an attacker to redirect SMTP email traffic to the attacker's server before sending packets on to their intended destinations. Which IP header value would help expose anomalies in the path outbound SMTP/Port 25 traffic takes compared to outbound packets sent to other ports?

AChecksum

BAcknowledgement number

CTime to live

DFragment offset

Suggested Answer: C

In a case study of a redirect tunnel set up on a router, some anomalies were noticed while watching network traffic with the TCPdump packet sniffer.

Packets going to port 25 (Simple Mail Transfer Protocol [SMTP] used by mail servers and other Mail Transfer Agents [MTAs] to send and receive e-mail) were apparently taking a different network path. The TLs were consistently three less than other destination ports, indicating another three network hops were taken.

Other IP header values listed, such as fragment offset. The acknowledgement number is a TCP, not IP, header field.

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

15 comments · newest first

Verona 11 months ago

Wait, I didn’t know TTL could be used like that!

Juliana 11 months ago

Acknowledgement number might not help with this specific issue.

Hyun 11 months ago

Not so sure about that, isn’t the checksum more relevant?

Svetlana 11 months ago

Totally agree, TTL can reveal path changes!

Celestina 11 months ago

I think the Time to live value would show differences in routing.

Dorthy 11 months ago

Fragment offset seems less relevant to this scenario. I lean towards TTL since it can indicate if the packet is taking an unusual route.

Cassi 12 months ago

I practiced a question similar to this, and I feel like the Acknowledgement number might not be the right choice since it’s more about confirming receipt rather than path anomalies.

Jennifer 12 months ago

I'm not entirely sure, but I remember something about the checksum being important for integrity. Could it help identify anomalies?

Marget 1 year ago

I think the Time to Live (TTL) value could be useful here since it changes as packets traverse different routers, right?

Madonna 1 year ago

I'm leaning towards the time to live (TTL) value. That's often a good way to detect if traffic is being routed through an unexpected path. I'll focus on that as my primary strategy for this question.

Ashton 1 year ago

The fragment offset seems like an interesting option. If the attacker is reconfiguring the router, that could potentially impact how the packets are fragmented. I'll have to think about that one a bit more.

Terrilyn 1 year ago

This seems like a tricky one, but I think the key is to look for any differences in the IP header values between the SMTP/Port 25 traffic and other outbound traffic. The time to live (TTL) value could be a good indicator of anomalies in the path.

Talia 1 year ago

Hmm, I'm not sure about this one. The checksum might be a good place to start, since that could potentially change if the traffic is being redirected. But I'm not totally confident that's the right answer.

Kiera 1 year ago

This looks like a tricky one. I'll need to carefully consider the different log sources and think about which one would provide the most relevant information for troubleshooting the password rotation issue.

Lelia 1 year ago

Behavior-based protection sounds like it could be related to endpoint security, so I'll try Cortex XDR.

GIAC GCED Exam - Topic 3 Question 31 Discussion