nerdexam
EC-Council

312-50V10 · Question #137

Based on the below log, which of the following sentences are true? Mar 1, 2016, 7:33:28 AM 10.240.250.23 ?54373 10.249.253.15 ?22 tcp_ip

The correct answer is C. Application is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server. The network log shows a TCP connection from 10.240.250.23 on an ephemeral port (54373) to 10.249.253.15 on port 22, which identifies the application as SSH and determines client/server roles from port numbers.

Sniffing

Question

Based on the below log, which of the following sentences are true? Mar 1, 2016, 7:33:28 AM 10.240.250.23 ?54373 10.249.253.15 ?22 tcp_ip

Options

  • ASSH communications are encrypted it's impossible to know who is the client or the server
  • BApplication is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server
  • CApplication is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server
  • DApplication is SSH and 10.240.250.23 is the server and 10.249.253.15 is the server

How the community answered

(69 responses)
  • A
    9% (6)
  • B
    4% (3)
  • C
    84% (58)
  • D
    3% (2)

Why each option

The network log shows a TCP connection from 10.240.250.23 on an ephemeral port (54373) to 10.249.253.15 on port 22, which identifies the application as SSH and determines client/server roles from port numbers.

ASSH communications are encrypted it's impossible to know who is the client or the server

Although SSH encrypts payload data, network logs always expose connection metadata including source/destination IPs and ports, which are sufficient to identify application and roles.

BApplication is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server

FTP uses well-known ports 20 and 21, not port 22; port 22 is exclusively associated with SSH.

CApplication is SSH and 10.240.250.23 is the client and 10.249.253.15 is the serverCorrect

Port 22 is the IANA-assigned well-known port for SSH. In TCP, the initiating client uses a high ephemeral source port (54373) while the listening server uses the well-known destination port (22), so 10.240.250.23 is the client and 10.249.253.15 is the server.

DApplication is SSH and 10.240.250.23 is the server and 10.249.253.15 is the server

A TCP session has one client and one server; 10.240.250.23 uses the ephemeral source port making it the client, so it cannot also be a server.

Concept tested: TCP port identification and client-server role analysis

Source: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Topics

#log analysis#SSH port 22#client-server identification#network traffic analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice