nerdexam
EC-Council

312-50V11 · Question #15

The following is part of a log file taken from the machine on the network with the IP address of 192.168.0.110: What type of activity has been logged?

The correct answer is C. Port scan targeting 192.168.0.110. Log entries showing sequential or rapid connection attempts across multiple ports on a single host (192.168.0.110) are characteristic of a port scan targeting that machine.

Scanning Networks

Question

The following is part of a log file taken from the machine on the network with the IP address of 192.168.0.110:

What type of activity has been logged?

Exhibit

312-50V11 question #15 exhibit

Options

  • ATeardrop attack targeting 192.168.0.110
  • BDenial of service attack targeting 192.168.0.105
  • CPort scan targeting 192.168.0.110
  • DPort scan targeting 192.168.0.105

How the community answered

(50 responses)
  • A
    2% (1)
  • B
    10% (5)
  • C
    82% (41)
  • D
    6% (3)

Why each option

Log entries showing sequential or rapid connection attempts across multiple ports on a single host (192.168.0.110) are characteristic of a port scan targeting that machine.

ATeardrop attack targeting 192.168.0.110

A teardrop attack sends fragmented IP packets with overlapping offset values to crash the target's TCP/IP stack; this would not produce the sequential port-probe log pattern described.

BDenial of service attack targeting 192.168.0.105

A denial of service attack targeting 192.168.0.105 would appear in the logs of that machine, not on 192.168.0.110, and DoS traffic patterns differ from port scan signatures.

CPort scan targeting 192.168.0.110Correct

A port scan generates log entries showing probe attempts against many different ports on a destination IP address in a short time frame, which is exactly what would appear on the machine at 192.168.0.110 receiving those probes. The log is captured on 192.168.0.110, so that host is the target - its logs record inbound connection attempts originating from an external source.

DPort scan targeting 192.168.0.105

A port scan targeting 192.168.0.105 would be logged by 192.168.0.105 as the recipient, not by 192.168.0.110; 192.168.0.110 could only log traffic directed at itself.

Concept tested: Identifying port scan activity from network logs

Source: https://nmap.org/book/man-port-scanning-basics.html

Topics

#port scan#log analysis#network scanning#traffic analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice