nerdexam
EC-Council

312-50V11 · Question #612

Destination unreachable administratively prohibited messages can inform the hacker to what?

The correct answer is D. That a router or other packet-filtering device is blocking traffic. An ICMP Type 3 Code 13 response reveals that a packet-filtering device - such as a router with an ACL or a stateful firewall - is actively blocking the traffic.

Scanning Networks

Question

Destination unreachable administratively prohibited messages can inform the hacker to what?

Options

  • AThat a circuit level proxy has been installed and is filtering traffic
  • BThat his/her scans are being blocked by a honeypot or jail
  • CThat the packets are being malformed by the scanning software
  • DThat a router or other packet-filtering device is blocking traffic
  • EThat the network is functioning normally

How the community answered

(20 responses)
  • A
    10% (2)
  • B
    5% (1)
  • D
    70% (14)
  • E
    15% (3)

Why each option

An ICMP Type 3 Code 13 response reveals that a packet-filtering device - such as a router with an ACL or a stateful firewall - is actively blocking the traffic.

AThat a circuit level proxy has been installed and is filtering traffic

Circuit-level proxies operate at the session layer and silently relay or drop connections rather than generating ICMP administratively prohibited messages back to the sender.

BThat his/her scans are being blocked by a honeypot or jail

Honeypots are designed to emulate legitimate services and attract attackers - they would not advertise their presence by sending administratively prohibited ICMP responses.

CThat the packets are being malformed by the scanning software

Malformed packets would typically cause application-layer parsing errors or silent drops, not a standardized ICMP Type 3 Code 13 response from a router.

DThat a router or other packet-filtering device is blocking trafficCorrect

ICMP Type 3 Code 13 is generated by routers and firewalls when an access control list or firewall rule explicitly denies a packet rather than the destination being simply unreachable. Receiving this message tells an attacker that an active filtering device is present and enforcing policy, which discloses the existence and approximate rule set of that security control, making it useful reconnaissance information.

EThat the network is functioning normally

An administratively prohibited message is an explicit security denial, not an indicator that the network is functioning without restrictions.

Concept tested: Reconnaissance interpretation of ICMP administratively prohibited

Source: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

Topics

#ICMP admin prohibited#packet filtering#router ACL#firewall detection

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice