312-50V11 · Question #612
Destination unreachable administratively prohibited messages can inform the hacker to what?
The correct answer is D. That a router or other packet-filtering device is blocking traffic. An ICMP Type 3 Code 13 response reveals that a packet-filtering device - such as a router with an ACL or a stateful firewall - is actively blocking the traffic.
Question
Destination unreachable administratively prohibited messages can inform the hacker to what?
Options
- AThat a circuit level proxy has been installed and is filtering traffic
- BThat his/her scans are being blocked by a honeypot or jail
- CThat the packets are being malformed by the scanning software
- DThat a router or other packet-filtering device is blocking traffic
- EThat the network is functioning normally
How the community answered
(20 responses)- A10% (2)
- B5% (1)
- D70% (14)
- E15% (3)
Why each option
An ICMP Type 3 Code 13 response reveals that a packet-filtering device - such as a router with an ACL or a stateful firewall - is actively blocking the traffic.
Circuit-level proxies operate at the session layer and silently relay or drop connections rather than generating ICMP administratively prohibited messages back to the sender.
Honeypots are designed to emulate legitimate services and attract attackers - they would not advertise their presence by sending administratively prohibited ICMP responses.
Malformed packets would typically cause application-layer parsing errors or silent drops, not a standardized ICMP Type 3 Code 13 response from a router.
ICMP Type 3 Code 13 is generated by routers and firewalls when an access control list or firewall rule explicitly denies a packet rather than the destination being simply unreachable. Receiving this message tells an attacker that an active filtering device is present and enforcing policy, which discloses the existence and approximate rule set of that security control, making it useful reconnaissance information.
An administratively prohibited message is an explicit security denial, not an indicator that the network is functioning without restrictions.
Concept tested: Reconnaissance interpretation of ICMP administratively prohibited
Source: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
Topics
Community Discussion
No community discussion yet for this question.