Discuss GIAC GSNA Exam Topic 3 Question 22

You work as a Network Administrator for Infosec Inc. Nowadays, you are facing an unauthorized access in your Wi-Fi network. Therefore, you analyze a log that has been recorded by your favorite sniffer, Ethereal. You are able to discover the cause of the unauthorized access after noticing the following string in the log file:

(Wlan.fc.type_subtype eq 32 and llc.oui eq 0x00601d and llc.pid eq 0x0001)

When you find All your 802.11b are belong to us as the payload string, you are convinced about which tool is being used for the

unauthorized access. Which of the following tools have you ascertained?

AAiroPeek

BAirSnort

CKismet

DNetStumbler

Suggested Answer: D

NetStumbler, a war driving tool, uses an organizationally unique identifier (OID) of 0x00601d and a protocol identifier (PID) of 0x0001. Each version has a typical payload string. For example, NetStumbler 3.2.3 has a payload string: 'All your 802.11b are belong to us'. Therefore, when you see the OID and PID values, you discover that the attacker is using NetStumbler, and when you see the payload string, you are able to ascertain that the attacker is using NetStumbler 3.2.3.

Get Premium GSNA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Maryrose 11 months ago

AirSnort could also be a contender, but I lean towards AiroPeek.

Tarra 11 months ago

AiroPeek has that payload string for sure!

Lon 12 months ago

Wait, are we sure about that?

Kenneth 12 months ago

I thought it was Kismet, but I guess not.

Goldie 12 months ago

That's definitely AiroPeek!

Gregoria 1 year ago

I feel like NetStumbler is more for network discovery, so it might not be the right choice here. I lean towards AiroPeek based on that payload.

Raylene 1 year ago

I practiced a similar question where we had to identify tools based on log analysis. Kismet seems like a possibility, but I can't recall the exact details.

Lea 1 year ago

I remember studying about packet sniffers, but I'm not entirely sure which one uses that specific payload string.

Galen 1 year ago

I think "All your 802.11b are belong to us" is associated with AiroPeek, but I might be mixing it up with another tool.

Pansy 1 year ago

Hmm, I'm not entirely sure about this one. I'll need to think it through carefully to make sure I understand the implications of the policy.

Sunny 1 year ago

This seems straightforward - I think the intangible values created by trust in business relationships are positive feedback from customers and more focus on the core business.

Lajuana 1 year ago

This seems like a tricky one. I'll need to really focus and make sure I understand the differences between the answer choices before selecting my final answer.

GIAC GSNA Exam - Topic 3 Question 22 Discussion