312-50V11 · Question #15
The following is part of a log file taken from the machine on the network with the IP address of 192.168.0.110: What type of activity has been logged?
The correct answer is C. Port scan targeting 192.168.0.110. Log entries showing sequential or rapid connection attempts across multiple ports on a single host (192.168.0.110) are characteristic of a port scan targeting that machine.
Question
The following is part of a log file taken from the machine on the network with the IP address of 192.168.0.110:
What type of activity has been logged?
Exhibit
Options
- ATeardrop attack targeting 192.168.0.110
- BDenial of service attack targeting 192.168.0.105
- CPort scan targeting 192.168.0.110
- DPort scan targeting 192.168.0.105
How the community answered
(50 responses)- A2% (1)
- B10% (5)
- C82% (41)
- D6% (3)
Why each option
Log entries showing sequential or rapid connection attempts across multiple ports on a single host (192.168.0.110) are characteristic of a port scan targeting that machine.
A teardrop attack sends fragmented IP packets with overlapping offset values to crash the target's TCP/IP stack; this would not produce the sequential port-probe log pattern described.
A denial of service attack targeting 192.168.0.105 would appear in the logs of that machine, not on 192.168.0.110, and DoS traffic patterns differ from port scan signatures.
A port scan generates log entries showing probe attempts against many different ports on a destination IP address in a short time frame, which is exactly what would appear on the machine at 192.168.0.110 receiving those probes. The log is captured on 192.168.0.110, so that host is the target - its logs record inbound connection attempts originating from an external source.
A port scan targeting 192.168.0.105 would be logged by 192.168.0.105 as the recipient, not by 192.168.0.110; 192.168.0.110 could only log traffic directed at itself.
Concept tested: Identifying port scan activity from network logs
Source: https://nmap.org/book/man-port-scanning-basics.html
Topics
Community Discussion
No community discussion yet for this question.
