nerdexam
EC-Council

312-50V11 · Question #371

Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?

The correct answer is A. Teardrop. The Teardrop attack exploits TCP/IP fragment reassembly by sending overlapping malformed IP fragments that the target OS cannot correctly reconstruct.

Denial of Service

Question

Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?

Options

  • ATeardrop
  • BSYN flood
  • CSmurf attack
  • DPing of death

How the community answered

(23 responses)
  • A
    87% (20)
  • B
    9% (2)
  • D
    4% (1)

Why each option

The Teardrop attack exploits TCP/IP fragment reassembly by sending overlapping malformed IP fragments that the target OS cannot correctly reconstruct.

ATeardropCorrect

Teardrop sends a sequence of IP fragments with deliberately overlapping offset values, causing the receiving system's TCP/IP stack to fail during reassembly as it cannot reconcile the conflicting fragment boundaries. This vulnerability in fragment reassembly logic can cause the target system to crash or hang, making it a denial-of-service attack specifically targeting the IP fragmentation mechanism.

BSYN flood

SYN flood exploits the TCP three-way handshake by sending large numbers of SYN packets without completing the connection, exhausting server connection tables rather than targeting fragmentation.

CSmurf attack

A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed victim source IP, amplifying traffic back to the victim and has no relation to fragment reassembly.

DPing of death

Ping of Death sends a single ICMP packet exceeding the 65,535-byte limit to crash systems, targeting packet size validation rather than the fragment reassembly logic.

Concept tested: Teardrop attack and IP fragment reassembly exploit

Source: https://www.cisa.gov/uscert/ncas/tips/ST04-015

Topics

#teardrop attack#IP fragmentation#fragment reassembly#TCP/IP vulnerabilities

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice