nerdexam
EC-Council

312-50V9 · Question #505

Destination unreachable administratively prohibited messages can inform the hacker to what?

The correct answer is D. That a router or other packet-filtering device is blocking traffic. ICMP Type 3 Code 13 'Destination Unreachable - Administratively Prohibited' messages indicate that a packet-filtering device is actively blocking traffic based on an access control policy.

Scanning Networks

Question

Destination unreachable administratively prohibited messages can inform the hacker to what?

Options

  • AThat a circuit level proxy has been installed and is filtering traffic
  • BThat his/her scans are being blocked by a honeypot or jail
  • CThat the packets are being malformed by the scanning software
  • DThat a router or other packet-filtering device is blocking traffic
  • EThat the network is functioning normally

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    13% (3)
  • C
    4% (1)
  • D
    75% (18)
  • E
    4% (1)

Why each option

ICMP Type 3 Code 13 'Destination Unreachable - Administratively Prohibited' messages indicate that a packet-filtering device is actively blocking traffic based on an access control policy.

AThat a circuit level proxy has been installed and is filtering traffic

Circuit-level proxies operate at the session layer and silently drop or reset connections rather than generating ICMP administratively prohibited messages.

BThat his/her scans are being blocked by a honeypot or jail

Honeypots are designed to attract and mimic services for attackers and do not typically respond with ICMP administratively prohibited messages.

CThat the packets are being malformed by the scanning software

Malformed packets would trigger ICMP Parameter Problem messages, not administratively prohibited messages.

DThat a router or other packet-filtering device is blocking trafficCorrect

ICMP Destination Unreachable code 13 (administratively prohibited) is generated specifically by routers, firewalls, or ACL-enforcing devices when a packet is blocked by a configured policy rule. This tells a hacker or scanner that a filtering device exists in the path and is dropping traffic based on administrative access control configuration.

EThat the network is functioning normally

An administratively prohibited message explicitly signals that traffic is being blocked, which is the opposite of normal network operation.

Concept tested: ICMP destination unreachable codes and firewall behavior

Source: https://www.rfc-editor.org/rfc/rfc792

Topics

#ICMP unreachable#packet filtering#firewall detection#router ACL

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice