312-49 · Question #438
You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company ITYou have been called in to help with an investigation of an…
The correct answer is A. Network. Routers operate at Layer 3 (Network layer) of the OSI model, making routing decisions based on IP addresses. When you Telnet into a router and capture traffic with Ethereal (now Wireshark), you are monitoring IP packets as they traverse the network - a Layer 3 function. The…
Question
You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company ITYou have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company? IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?
Options
- ANetwork
- BTransport
- CData Link
- DSession
How the community answered
(38 responses)- A92% (35)
- B5% (2)
- D3% (1)
Explanation
Routers operate at Layer 3 (Network layer) of the OSI model, making routing decisions based on IP addresses. When you Telnet into a router and capture traffic with Ethereal (now Wireshark), you are monitoring IP packets as they traverse the network - a Layer 3 function. The Network layer handles logical addressing and packet forwarding between networks. While packet capture tools can inspect multiple layers, the primary layer relevant to router traffic analysis is the Network layer, since routers forward packets based on IP (Layer 3) information.
Topics
Community Discussion
No community discussion yet for this question.