200-201 · Question #344
Refer to the exhibit. A network engineer is analyzing a network activity within captured traffic. An engineer notices suspicious behavior, a type of ICMP that Wireshark does not recognize. What is…
The correct answer is B. These are responses from destination because the destination network is unreachable for this. The suspicious behavior, interpreted by the engineer as an unrecognized ICMP type, suggests responses from a destination indicating unreachability, such as a network or host being inaccessible.
Question
Refer to the exhibit. A network engineer is analyzing a network activity within captured traffic. An engineer notices suspicious behavior, a type of ICMP that Wireshark does not recognize. What is occurring?
Exhibit
Options
- AThese are failed communication attempts because ICMP communication is administratively
- BThese are responses from destination because the destination network is unreachable for this
- CWireshark cannot map the type of ICMP requests because they are not legitimate ICMP echo
- DWireshark cannot map the type due to fragmentation, and fragment ID was not set on the
How the community answered
(60 responses)- A3% (2)
- B73% (44)
- C7% (4)
- D17% (10)
Why each option
The suspicious behavior, interpreted by the engineer as an unrecognized ICMP type, suggests responses from a destination indicating unreachability, such as a network or host being inaccessible.
While 'administratively prohibited' is an ICMP unreachable code, this option focuses on the cause rather than the observed suspicious ICMP type and its immediate implication of unreachability.
ICMP Destination Unreachable messages (Type 3) are responses generated by routers or hosts when a packet cannot be delivered to its intended destination. If an engineer observes unexpected or high volumes of these messages, it signals suspicious network activity such as misconfiguration, network segmentation issues, or an attempt to access restricted areas, indicating the destination network is unreachable.
This option specifies 'ICMP requests' that are not legitimate echo, whereas 'destination unreachable' is a common ICMP response, not a request.
IP fragmentation issues primarily affect the reassembly of IP packets, not the identification or mapping of the ICMP type itself within the packet.
Concept tested: ICMP message analysis (Destination Unreachable)
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/icmp/icmp-message-overview
Topics
Community Discussion
No community discussion yet for this question.