312-50V11 · Question #198
The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106: What type of activity has been logged?
The correct answer is D. Port scan targeting 192.168.1.106. The log entries show sequential connection attempts to multiple ports on 192.168.1.106 from another host, which is the defining characteristic of a port scan targeting that machine.
Question
The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:
What type of activity has been logged?
Exhibit
Options
- APort scan targeting 192.168.1.103
- BTeardrop attack targeting 192.168.1.106
- CDenial of service attack targeting 192.168.1.103
- DPort scan targeting 192.168.1.106
How the community answered
(24 responses)- A4% (1)
- B17% (4)
- C4% (1)
- D75% (18)
Why each option
The log entries show sequential connection attempts to multiple ports on 192.168.1.106 from another host, which is the defining characteristic of a port scan targeting that machine.
A port scan targeting 192.168.1.103 would show the probes directed at .103 as the destination; the log belongs to .106 and records traffic received by that host.
A teardrop attack involves sending malformed, overlapping IP fragments to crash the target's TCP/IP stack - it would not appear as sequential port connection attempts in a standard log.
A denial-of-service attack against .103 would appear as high-volume traffic sent from .106 toward .103, which is the reverse of what the log on .106 would capture.
A port scan is identified by rapid, sequential or systematic connection attempts across multiple ports on a single target IP. Because the log records multiple attempts directed at 192.168.1.106 across different port numbers, the target of the scan is 192.168.1.106, not .103. The machine at .106 is the one logging inbound probe packets.
Concept tested: Identifying port scan activity from log analysis
Source: https://nmap.org/book/man-port-scanning-basics.html
Topics
Community Discussion
No community discussion yet for this question.
