312-50V9 · Question #517
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0…
The correct answer is B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system. Identical ICMP ID and Seq values across packets from 47 different source IPs indicate the values were hardcoded by a scanning or attack tool, not generated by an OS.
Question
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?
Options
- AThe packets were sent by a worm spoofing the IP addresses of 47 infected sites
- BICMP ID and Seq numbers were most likely set by a tool and not by the operating system
- CAll 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
- D13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0
How the community answered
(32 responses)- A13% (4)
- B59% (19)
- C6% (2)
- D22% (7)
Why each option
Identical ICMP ID and Seq values across packets from 47 different source IPs indicate the values were hardcoded by a scanning or attack tool, not generated by an OS.
A worm spreading across 47 infected hosts would still use each host OS's ICMP stack, which would generate varied ID and Seq values, not identical ones.
Operating systems increment ICMP ID and Seq fields uniquely per socket or session, so receiving 77 packets with the exact same ICMP ID:39612 and Seq:57072 from 47 distinct sources is statistically impossible under normal OS behavior. This pattern is a hallmark of a tool such as hping or a custom scanner that sets static field values. The anomaly reveals deliberate crafting rather than organic traffic generation.
Hosts on the same LAN segment each maintain independent ICMP counters, so same-segment placement does not cause identical ICMP ID and Seq across multiple source IPs.
Some NAT implementations do reset ICMP ID to 0 during translation, which may explain the 13 packets, but that observation does not account for the dominant pattern of 77 packets with identical non-zero values.
Concept tested: ICMP header field analysis for crafted packet detection
Source: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
Topics
Community Discussion
No community discussion yet for this question.