200-201 · Question #137
Refer to the exhibit. What is occurring in this network traffic?
The correct answer is D. flood of SYN packets coming from a single source IP to a single destination IP. The network traffic depicted indicates a high volume of SYN packets originating from a single source IP address targeting a single destination IP address.
Question
Refer to the exhibit. What is occurring in this network traffic?
Exhibit
Options
- Ahigh rate of SYN packets being sent from a multiple source towards a single destination IP
- Bhigh rate of SYN packets being sent from a single source IP towards multiple destination IPs
- Cflood of ACK packets coming from a single source IP to multiple destination IPs
- Dflood of SYN packets coming from a single source IP to a single destination IP
How the community answered
(28 responses)- A14% (4)
- B4% (1)
- C7% (2)
- D75% (21)
Why each option
The network traffic depicted indicates a high volume of SYN packets originating from a single source IP address targeting a single destination IP address.
A high rate of SYN packets from *multiple* sources towards a single destination describes a Distributed SYN flood (DDoS), which is different from a single source.
A high rate of SYN packets from a single source IP towards *multiple* destination IPs is characteristic of a port scan, not a flood against a single target.
A flood of ACK packets is a distinct type of attack and would display different packet characteristics than a SYN flood.
This scenario describes a SYN flood, a denial-of-service attack where an attacker sends a high rate of SYN packets from one source to one target's open ports. The target responds with SYN-ACKs and dedicates resources, eventually exhausting its connection table and becoming unresponsive.
Concept tested: SYN flood attack identification
Source: https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-attack-types
Topics
Community Discussion
No community discussion yet for this question.