nerdexam
EC-Council

312-50V9 · Question #433

The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106: Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106…

The correct answer is D. Port scan targeting 192.168.1.106. The log shows sequential TCP connection attempts to incrementing port numbers on 192.168.1.106, which is the classic signature of a port scan.

Scanning Networks

Question

The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:

Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP What type of activity has been logged?

Options

  • APort scan targeting 192.168.1.103
  • BTeardrop attack targeting 192.168.1.106
  • CDenial of service attack targeting 192.168.1.103
  • DPort scan targeting 192.168.1.106

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    14% (6)
  • C
    9% (4)
  • D
    74% (32)

Why each option

The log shows sequential TCP connection attempts to incrementing port numbers on 192.168.1.106, which is the classic signature of a port scan.

APort scan targeting 192.168.1.103

192.168.1.103 is the source initiating the connections, not the target; the destination receiving the probes is 192.168.1.106.

BTeardrop attack targeting 192.168.1.106

A Teardrop attack exploits IP fragmentation by sending overlapping malformed fragments to crash a target, which bears no resemblance to the sequential port probing shown.

CDenial of service attack targeting 192.168.1.103

A denial of service attack floods a single port or service with high-volume traffic to exhaust resources, not sequentially probe multiple ports at low frequency.

DPort scan targeting 192.168.1.106Correct

A port scan is characterized by a single source systematically probing multiple ports on a destination host in rapid succession. Here, 192.168.1.103 is the source probing ports 20, 21, 22, 23, 25, 80, and 443 on the destination 192.168.1.106 in sequential order within seconds, which is the textbook pattern of a TCP port scan.

Concept tested: Identifying port scan patterns in network logs

Source: https://nmap.org/book/man-port-scanning-basics.html

Topics

#port scan#sequential scanning#log analysis#TCP scanning

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice