312-50V13 · Question #329
Based on the below log, which of the following sentences are true? Mar 1, 2016, 7:33:28 AM 10.240.250.23 54373 10.249.253.15 22 tcp_ip
The correct answer is D. Application is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server. Analyzing the log entry Mar 1, 2016, 7:33:28 AM 10.240.250.23 54373 10.249.253.15 22 tcp_ip indicates an SSH connection where 10.240.250.23 is the client and 10.249.253.15 is the server.
Question
Options
- AApplication is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server.
- BApplication is SSH and 10.240.250.23 is the server and 10.249.253.15 is the client.
- CSSH communications are encrypted; it's impossible to know who is the client or the server.
- DApplication is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server.
How the community answered
(34 responses)- A3% (1)
- B6% (2)
- C15% (5)
- D76% (26)
Why each option
Analyzing the log entry `Mar 1, 2016, 7:33:28 AM 10.240.250.23 54373 10.249.253.15 22 tcp_ip` indicates an SSH connection where 10.240.250.23 is the client and 10.249.253.15 is the server.
FTP uses ports 20 and 21, not 22, and the client/server roles would be reversed based on typical ephemeral-to-well-known port connections.
While the application is SSH (port 22), the client and server roles are incorrectly identified; the client connects from the ephemeral port.
Although SSH communications are encrypted, the port number (22) and the client-server port convention allow identification of the application and the roles of the communicating parties.
The log shows a connection to port 22 (`10.249.253.15 - 22`), which is the well-known port for SSH. The originating IP `10.240.250.23` uses a high-numbered ephemeral port (`54373`), indicating it is the client initiating the connection to the server on the well-known port.
Concept tested: Network log analysis, well-known ports, and client/server roles
Topics
Community Discussion
No community discussion yet for this question.