312-49 · Question #234
An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?
The correct answer is B. Ping of death. The maximum legal size of an IP packet (including headers) is 65,535 bytes. A 'Ping of Death' attack exploits this by sending malformed ICMP (ping) packets that exceed this 65,535-byte limit. When the target system attempts to reassemble these oversized fragmented packets, it…
Question
An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?
Options
- ASmurf
- BPing of death
- CFraggle
- DNmap scan
How the community answered
(23 responses)- A4% (1)
- B91% (21)
- D4% (1)
Explanation
The maximum legal size of an IP packet (including headers) is 65,535 bytes. A 'Ping of Death' attack exploits this by sending malformed ICMP (ping) packets that exceed this 65,535-byte limit. When the target system attempts to reassemble these oversized fragmented packets, it can cause buffer overflows, crashes, or reboots. A Smurf attack uses ICMP broadcast amplification, a Fraggle attack uses UDP instead of ICMP, and an Nmap scan uses various probes but does not specifically involve oversized ICMP packets.
Topics
Community Discussion
No community discussion yet for this question.