nerdexam
EC-Council

312-50V9 · Question #514

Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is…

The correct answer is D. The attacker is trying to determine the type of VPN implementation and checking for IPSec. UDP port 500 is the well-known port for IKE (Internet Key Exchange), the protocol used to establish IPSec VPN tunnels. Scanning port 500 across multiple hosts indicates VPN gateway reconnaissance.

Scanning Networks

Question

Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan?

Options

  • AIt is a network fault and the originating machine is in a network loop
  • BIt is a worm that is malfunctioning or hardcoded to scan on port 500
  • CThe attacker is trying to detect machines on the network which have SSL enabled
  • DThe attacker is trying to determine the type of VPN implementation and checking for IPSec

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    23% (6)
  • C
    12% (3)
  • D
    62% (16)

Why each option

UDP port 500 is the well-known port for IKE (Internet Key Exchange), the protocol used to establish IPSec VPN tunnels. Scanning port 500 across multiple hosts indicates VPN gateway reconnaissance.

AIt is a network fault and the originating machine is in a network loop

Network loops produce broadcast storms or spanning-tree events, not directed port 500 traffic aimed at multiple specific hosts.

BIt is a worm that is malfunctioning or hardcoded to scan on port 500

While worms can exploit specific ports, port 500 is not a generic worm propagation port and the described behavior is deliberate targeted reconnaissance, not opportunistic worm spreading.

CThe attacker is trying to detect machines on the network which have SSL enabled

SSL/TLS traffic operates on TCP port 443, not UDP port 500, so this scan has no relation to detecting SSL-enabled machines.

DThe attacker is trying to determine the type of VPN implementation and checking for IPSecCorrect

UDP port 500 is assigned to IKE (Internet Key Exchange), which handles Phase 1 negotiation of IPSec VPNs. An attacker scanning from port 500 to port 500 on many hosts is probing for machines that respond to IKE, revealing the presence and potentially the implementation details of IPSec-based VPN endpoints. This is a classic reconnaissance technique used to map out VPN infrastructure before attempting further exploitation.

Concept tested: IKE/IPSec port 500 VPN reconnaissance

Source: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Topics

#port 500#IPSec#VPN fingerprinting#traffic analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice