An attacker used the ping-of-death (PoD) technique to crash a target Android device. The network traffic was captured by the SOC team and was provided to you to perform a detailed analysis. Analyze…

Question

Options

• A52
• B056
• C58
• D54

• A
  4% (2)
• B
  15% (8)
• C
  8% (4)
• D
  74% (39)

Explanation

Ping-of-Death Packet Length Analysis

Option D (54 bytes) is correct because when analyzing the android.pcapng capture file in Wireshark, the PoD packets crafted to crash the Android device measure 54 bytes in total length - this reflects the combined size of the Ethernet frame header (14 bytes), IPv4 header (20 bytes), ICMP header (8 bytes), and the malicious payload, which can be verified in the packet details pane under the "Length" column or frame info.

• Option A (52 bytes) is incorrect as it falls short of the actual captured packet length and doesn't align with the standard header structure observed in the pcap.
• Option B (056 bytes) is incorrect; while written unusually with a leading zero, 56 bytes would suggest extra padding beyond what was captured in this specific attack scenario.
• Option C (58 bytes) is incorrect as it overshoots the measured frame length seen in the actual capture file analysis.

Memory Tip: When analyzing PoD attacks in Wireshark, always check the "Length" column or the frame details at the bottom pane. Remember: 14 (Ethernet) + 20 (IP) + 8 (ICMP) = 42 bytes minimum, so any additional payload bytes bring it to 54 - look for this signature value in Android-targeted PoD captures.

No community discussion yet for this question.