nerdexam
EC-Council

312-50V11 · Question #621

Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concer

The correct answer is D. The attacker is trying to determine the type of VPN implementation and checking for IPSec. Port 500 is the well-known UDP port used by IKE (Internet Key Exchange), the key management protocol for IPSec VPNs. Traffic from one host to port 500 on many targets indicates reconnaissance for VPN-capable machines.

Scanning Networks

Question

Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan?

Options

  • AIt is a network fault and the originating machine is in a network loop
  • BIt is a worm that is malfunctioning or hardcoded to scan on port 500
  • CThe attacker is trying to detect machines on the network which have SSL enabled
  • DThe attacker is trying to determine the type of VPN implementation and checking for IPSec

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    11% (2)
  • C
    22% (4)
  • D
    61% (11)

Why each option

Port 500 is the well-known UDP port used by IKE (Internet Key Exchange), the key management protocol for IPSec VPNs. Traffic from one host to port 500 on many targets indicates reconnaissance for VPN-capable machines.

AIt is a network fault and the originating machine is in a network loop

A network loop would cause a broadcast storm on Layer 2 and would not be limited to a specific application port like 500.

BIt is a worm that is malfunctioning or hardcoded to scan on port 500

A worm scanning port 500 is theoretically possible, but the dominant and well-established reason to target port 500 specifically is VPN/IPSec discovery, not a malfunctioning worm.

CThe attacker is trying to detect machines on the network which have SSL enabled

SSL/TLS operates on ports like 443 and 8443, not port 500; port 500 has no association with SSL.

DThe attacker is trying to determine the type of VPN implementation and checking for IPSecCorrect

UDP port 500 is exclusively reserved for IKE (Internet Key Exchange), which is the negotiation protocol underlying IPSec VPN tunnels. An attacker scanning port 500 across multiple hosts is probing to discover which systems are running IPSec VPN services and to fingerprint the VPN implementation (e.g., Cisco, CheckPoint, OpenSwan) based on the response payloads. This is a targeted reconnaissance technique, not random noise.

Concept tested: IKE port 500 and IPSec VPN reconnaissance

Source: https://datatracker.ietf.org/doc/html/rfc7296

Topics

#port 500#IPSec#IKE#VPN detection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice