CAS-001 · Question #297
An administrator receives reports that the network is running slow for users connected to a certain switch. Viewing the network traffic, the administrator reviews the following: 18:51:59.042108 IP…
The correct answer is B. Improper network zoning. The critical clue in the packet capture is the presence of iSCSI traffic (port 860/3260, used for storage area network block-level storage) on the same network segment as workstation DNS and user traffic. iSCSI generates high-volume, bursty traffic that is extremely sensitive…
Question
An administrator receives reports that the network is running slow for users connected to a certain switch. Viewing the network traffic, the administrator reviews the following:
18:51:59.042108 IP linuxwksta.55467 > dns.company.com.domain: 39462+ PTR? 222.17.4.10.in- addr.arpa. (42) 18:51:59.055732 IP dns.company.com.domain > linuxwksta.55467: 39462 NXDomain 0/0/0 (42) 18:51:59.055842 IP linuxwksta.48287 > dns.company.com.domain: 46767+ PTR? 255.19.4.10.in- addr.arpa. (42) 18:51:59.069816 IP dns.company.com.domain > linuxwksta.48287: 46767 NXDomain 0/0/0 (42) 18:51:59.159060 IP linuxwksta.42491 > 10.4.17.72.iscsi-target: Flags [P.], seq 1989625106:1989625154, ack 2067334822, win 1525, options [nop,nop,TS val 16021424 ecr 215646227], length 48 18:51:59.159145 IP linuxwksta.48854 > dns.company.com.domain: 3834+ PTR? 72.17.4.10.in- addr.arpa. (41) 18:51:59.159314 IP 10.4.17.72.iscsi-target > linuxwksta.42491: Flags [P.], seq 1:49, ack 48, win 124, options [nop,nop,TS val 215647479 ecr 16021424], length 48 18:51:59.159330 IP linuxwksta.42491 > 10.4.17.72.iscsi-target: Flags [.], ack 49, win 1525, options [nop,nop,TS val 16021424 ecr 215647479], length 0 18:51:59.165342 IP dns.company.com.domain > linuxwksta.48854: 3834 NXDomain 0/0/0 (41) 18:51:59.397461 ARP, Request who-has 10.4.16.58 tell 10.4.16.1, length 46 18:51:59.397597 IP linuxwksta.37684 > dns.company.com.domain: 15022+ PTR? 58.16.4.10.in- addr.arpa. (41) Given the traffic report, which of the following is MOST likely causing the slow traffic?
Options
- ADNS poisoning
- BImproper network zoning
- CARP poisoning
- DImproper LUN masking
How the community answered
(34 responses)- A3% (1)
- B68% (23)
- C12% (4)
- D18% (6)
Explanation
The critical clue in the packet capture is the presence of iSCSI traffic (port 860/3260, used for storage area network block-level storage) on the same network segment as workstation DNS and user traffic. iSCSI generates high-volume, bursty traffic that is extremely sensitive to latency and should always reside on a dedicated, isolated network or VLAN, separate from user/workstation traffic. Its presence on the same switch segment indicates improper network zoning - storage traffic and user traffic are not segregated as they should be, causing congestion and slowness. Option A (DNS poisoning) is not supported; the NXDomain responses are normal failed reverse-lookup results. Option C (ARP poisoning) would show forged ARP replies. Option D (improper LUN masking) is a storage misconfiguration but wouldn't manifest as network slowness visible in a packet capture the same way.
Topics
Community Discussion
No community discussion yet for this question.