nerdexam
CompTIA

CAS-002 · Question #819

The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The following information is compiled: Caller 1, IP 172.16.35.217, NETMASK…

The correct answer is D. A denial of service attack is targeting at the router. The packet capture shows ICMP echo requests directed at the broadcast address with the router as the apparent source, indicating a Smurf-style denial of service attack flooding the router with replies.

Research and Analysis

Question

The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The following information is compiled:

Caller 1, IP 172.16.35.217, NETMASK 255.255.254.0 Caller 2, IP 172.16.35.53, NETMASK 255.255.254.0 Caller 3, IP 172.16.35.173, NETMASK 255.255.254.0 All callers are connected to the same switch and are routed by a router with five built-in interfaces. The upstream router interface's MAC is 00-01-42-32-ab-1a A packet capture shows the following:

09:05:15.934840 arp reply 172.16.34.1 is-at 00:01:42:32:ab:1a (00:01:42:32:ab:1a) 09:06:16.124850 arp reply 172.16.34.1 is-at 00:01:42:32:ab:1a (00:01:42:32:ab:1a) 09:07:25.439811 arp reply 172.16.34.1 is-at 00:01:42:32:ab:1a (00:01:42:32:ab:1a) 09:08:10.937590 IP 172.16.35.1 > 172.16.35.255: ICMP echo request, id 2305, seq 1, length 65534 09:08:10.937591 IP 172.16.35.1 > 172.16.35.255: ICMP echo request, id 2306, seq 2, length 65534 09:08:10.937592 IP 172.16.35.1 > 172.16.35.255: ICMP echo request, id 2307, seq 3, length 65534 Which of the following is occurring on the network?

Options

  • AA man-in-the-middle attack is underway on the network.
  • BAn ARP flood attack is targeting at the router.
  • CThe default gateway is being spoofed on the network.
  • DA denial of service attack is targeting at the router.

How the community answered

(55 responses)
  • A
    20% (11)
  • B
    13% (7)
  • C
    5% (3)
  • D
    62% (34)

Why each option

The packet capture shows ICMP echo requests directed at the broadcast address with the router as the apparent source, indicating a Smurf-style denial of service attack flooding the router with replies.

AA man-in-the-middle attack is underway on the network.

A man-in-the-middle attack via ARP poisoning would show a fraudulent MAC address in the ARP replies, but the capture shows the legitimate router MAC (00:01:42:32:ab:1a), so no impersonation is occurring.

BAn ARP flood attack is targeting at the router.

The ARP replies appear at roughly one-minute intervals, which is not characteristic of a flood attack - a true ARP flood would show thousands of rapid successive ARP frames.

CThe default gateway is being spoofed on the network.

The ARP replies correctly map 172.16.34.1 to the router's actual MAC address (00:01:42:32:ab:1a) that was provided as legitimate, so the default gateway is not being spoofed.

DA denial of service attack is targeting at the router.Correct

The capture line 'IP 172.16.35.1 > 172.16.35.255: ICMP e' shows ICMP echo traffic destined for the subnet broadcast address with the router's IP as the source. In a Smurf attack, an attacker spoofs the victim's IP (the router) as the source and sends ICMP requests to the broadcast address, causing every host on the subnet to reply to the router simultaneously - producing the slow and intermittent connectivity reported by callers.

Concept tested: Smurf DoS attack via ICMP broadcast amplification

Source: https://www.cisco.com/c/en/us/about/security-center/smurf.html

Topics

#ARP spoofing#packet capture analysis#network forensics#denial of service

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice