200-201 · Question #298
Refer to exhibit. Which alert is identified from this packet?
The correct answer is B. SYN flood. The packet capture shows numerous TCP SYN packets sent from a single source to a single destination port in rapid succession, which is characteristic of a SYN flood attack.
Question
Refer to exhibit. Which alert is identified from this packet?
Exhibit
Options
- ASSDP amplification
- BSYN flood
- CTCP fragmentation attack
- DFraggle attack
How the community answered
(27 responses)- A15% (4)
- B78% (21)
- C4% (1)
- D4% (1)
Why each option
The packet capture shows numerous TCP SYN packets sent from a single source to a single destination port in rapid succession, which is characteristic of a SYN flood attack.
SSDP amplification attacks utilize UDP, not TCP, and involve spoofed source IPs and reflections, which are not visible in this TCP-based SYN flood scenario.
The Wireshark capture displays a high volume of TCP packets with only the `[SYN]` flag set, originating from one source IP to a single destination port (80), without any corresponding SYN-ACK or ACK packets, which is the defining characteristic of a SYN flood denial-of-service attack.
A TCP fragmentation attack involves breaking legitimate TCP packets into small fragments to evade detection or reassembly, which is not indicated by the uniform SYN packets of length 0.
A Fraggle attack is a UDP-based reflective DoS attack that uses ICMP, not TCP SYN packets, to overwhelm a target.
Concept tested: Wireshark analysis, SYN flood attack identification
Source: https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/
Topics
Community Discussion
No community discussion yet for this question.