Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan?

Question

Accepted Answer

D. The attacker is trying to determine the type of VPN implementation and checking for IPSec Port 500 is the well-known port assigned by IANA to IKE, the protocol that negotiates and establishes IPSec security associations for VPN tunnels. An attacker scanning many machines on port 500 is probing to discover which hosts are acting as IPSec VPN endpoints and to fingerprint the VPN implementation in use. This reconnaissance would precede a targeted attack against the VPN infrastructure.

Answer

A. It is a network fault and the originating machine is in a network loop A network loop causes broadcast storms and spanning-tree issues, not deliberate port 500 unicast traffic directed at multiple specific hosts.

Answer

B. It is a worm that is malfunctioning or hardcoded to scan on port 500 Malware typically scans common vulnerability ports or random high ports; hardcoding port 500 without context would be unusual and misses the IKE-specific significance of that port.

Answer

C. The attacker is trying to detect machines on the network which have SSL enabled SSL/TLS uses port 443 for HTTPS, not port 500; port 500 has no association with SSL detection.

Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concer

Question

Options

How the community answered

Why each option

Topics

Community Discussion