Miko was hired as an incident handler in XYZ company. His first task was to identify the PING sweep attempts inside the network. For this purpose, he used Wireshark to analyze the traffic. What…

The correct answer is C. icmp.type == 8 or icmp.type ==0. In Wireshark, to identify ICMP ping sweep attempts, the filter icmp.type == 8 or icmp.type ==0 is used. This filter captures ICMP echo requests and echo replies, which are indicative of ping commands. Type 8 represents an echo request used when a source sends a ping, and type 0…

Incident Handling and Response Technologies

Question

Miko was hired as an incident handler in XYZ company. His first task was to identify the PING sweep attempts inside the network. For this purpose, he used Wireshark to analyze the traffic. What filter did he use to identify ICMP ping sweep attempts?

Options

Atcp.typc == icmp
Bicrrip.lype == icmp
Cicmp.type == 8 or icmp.type ==0
Dudp.lype -- 7

How the community answered

(37 responses)

A
11% (4)
B
3% (1)
C
81% (30)
D
5% (2)

Explanation

In Wireshark, to identify ICMP ping sweep attempts, the filter icmp.type == 8 or icmp.type ==0 is used. This filter captures ICMP echo requests and echo replies, which are indicative of ping commands. Type 8 represents an echo request used when a source sends a ping, and type 0 represents an echo reply, which is the response from the target. By filtering for these ICMP types, Miko can detect a surge in ping requests across the network, which could indicate a ping sweep attempt--an exploratory activity often used by attackers to discover active hosts on a network by sending ping requests to multiple addresses.

Topics

#Wireshark filters#ICMP#ping sweep detection#network forensics

Community Discussion

No community discussion yet for this question.

Full 212-89 Practice