312-50V10 · Question #624
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 an
The correct answer is B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system. Identical non-zero, non-incrementing ICMP ID and Seq values across packets from 47 different source hosts is a strong indicator that those fields were hardcoded by a scanning or attack tool rather than assigned by each host's operating system.
Question
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?
Options
- AThe packets were sent by a worm spoofing the IP addresses of 47 infected sites
- BICMP ID and Seq numbers were most likely set by a tool and not by the operating system
- CAll 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq
- D13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0
How the community answered
(35 responses)- A11% (4)
- B60% (21)
- C6% (2)
- D23% (8)
Why each option
Identical non-zero, non-incrementing ICMP ID and Seq values across packets from 47 different source hosts is a strong indicator that those fields were hardcoded by a scanning or attack tool rather than assigned by each host's operating system.
A worm propagating across 47 hosts would use each host's OS to generate ICMP packets, resulting in varied IDs and Seq numbers - not identical values across all infected sources.
Operating systems generate ICMP echo requests with unique or incrementing ID and Seq values per host and per session; 77 packets from 47 independent sources all sharing ICMP ID:39612 and Seq:57072 is statistically impossible under normal OS behavior. These static values are a classic signature of a tool - such as a flood generator or custom scanner - that hardcodes ICMP header fields rather than delegating field assignment to the OS networking stack.
Hosts on the same LAN segment still use OS-assigned ICMP IDs and Seq numbers that differ per host; network topology does not cause multiple independent hosts to emit packets with identical header fields.
While some NAT implementations zero out ICMP IDs, this explains only the 13 packets with ID:0 and Seq:0 - it does not explain why 77 packets from 47 allegedly distinct sources share the same non-zero ID and Seq values.
Concept tested: ICMP header anomaly analysis and tool-generated traffic identification
Topics
Community Discussion
No community discussion yet for this question.