350-201 · Question #90
Refer to the exhibit. What is the threat in this Wireshark traffic capture?
The correct answer is D. A flood of SYN packets coming from a single source IP to a single destination IP. The Wireshark capture shows a TCP SYN flood denial-of-service attack, where a single source IP sends a high volume of SYN packets to a single destination IP to exhaust its connection state table.
Question
Refer to the exhibit. What is the threat in this Wireshark traffic capture?
Exhibit
Options
- AA high rate of SYN packets being sent from multiple sources toward a single destination IP
- BA flood of ACK packets coming from a single source IP to multiple destination IPs
- CA high rate of SYN packets being sent from a single source IP toward multiple destination IPs
- DA flood of SYN packets coming from a single source IP to a single destination IP
How the community answered
(39 responses)- A8% (3)
- B15% (6)
- C3% (1)
- D74% (29)
Why each option
The Wireshark capture shows a TCP SYN flood denial-of-service attack, where a single source IP sends a high volume of SYN packets to a single destination IP to exhaust its connection state table.
SYN packets arriving from multiple sources toward a single destination describes a distributed SYN flood (DDoS), which is a different attack pattern requiring multiple compromised hosts - not what a single-source capture shows.
A flood of ACK packets from a single source to multiple destinations describes an ACK flood or a reflective amplification pattern, which is a distinct attack type not consistent with the SYN-based traffic shown in the capture.
SYN packets sent from one source toward multiple destination IPs describes network reconnaissance or a port scan across a subnet, not a focused denial-of-service SYN flood targeting a single host.
A SYN flood is a denial-of-service attack in which an attacker sends a continuous stream of TCP SYN packets to a target server from one source IP, causing the server to allocate resources for half-open connections that are never completed by the three-way handshake. The server's connection table fills to capacity, preventing it from accepting legitimate new connections. In Wireshark, this pattern is visible as a high volume of SYN packets from a single source IP all directed at the same destination IP with no corresponding ACK completions from the initiating side.
Concept tested: TCP SYN flood DoS attack identification in packet capture
Source: https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/
Topics
Community Discussion
No community discussion yet for this question.
