nerdexam
GIAC

GCIA · Question #122

You are using a Windows-based sniffer named ASniffer to record the data traffic of a network. You have extracted the following IP Header information of a randomly chosen packet from the sniffer's…

The correct answer is C. 41, TCP. Parsing the raw IP header hex reveals TTL byte 0x29 equals 41 decimal and protocol byte 0x06 identifies TCP.

Packet Analysis with Wireshark & Command Line Tools

Question

You are using a Windows-based sniffer named ASniffer to record the data traffic of a network. You have extracted the following IP Header information of a randomly chosen packet from the sniffer's log:

45 00 00 28 00 00 40 00 29 06 43 CB D2 D3 82 5A 3B 5E AA 72 Which of the following TTL decimal values and protocols are being carried by the IP Header of this packet?

Options

  • A41, UDP
  • B16, ICMP
  • C41, TCP
  • D16, UDP

How the community answered

(52 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    85% (44)
  • D
    8% (4)

Why each option

Parsing the raw IP header hex reveals TTL byte 0x29 equals 41 decimal and protocol byte 0x06 identifies TCP.

A41, UDP

Protocol 0x06 is TCP, not UDP (UDP is protocol 0x11/17 decimal), so the protocol portion of this choice is incorrect.

B16, ICMP

TTL 0x29 is 41, not 16, and ICMP is protocol 0x01, neither of which match the header values extracted.

C41, TCPCorrect

In the IPv4 header, byte offset 8 (0-indexed) holds the TTL field: 0x29 hexadecimal converts to 41 decimal. Byte offset 9 holds the Protocol field: 0x06 maps to TCP per IANA protocol numbers. Both values together uniquely identify answer C as correct.

D16, UDP

TTL 0x29 decodes to 41, not 16, and the protocol byte 0x06 represents TCP, not UDP, making both fields in this choice incorrect.

Concept tested: IPv4 header field decoding - TTL and protocol

Source: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml

Topics

#IP header analysis#TTL decoding#protocol identification#hex to decimal

Community Discussion

No community discussion yet for this question.

Full GCIA Practice