nerdexam
GIAC

GCIA · Question #34

Adam, a malicious hacker purposely sends fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes. On the basis of above information, whic

The correct answer is D. Ping of death attack. A Ping of Death attack sends fragmented ICMP packets that reconstruct to a size exceeding the 65,535-byte IP maximum, causing buffer overflows or crashes on the target.

Network Traffic Analysis & Protocol Review

Question

Adam, a malicious hacker purposely sends fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes. On the basis of above information, which of the following types of attack is Adam attempting to perform?

Options

  • AFraggle attack
  • BSYN Flood attack
  • CLand attack
  • DPing of death attack

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    14% (7)
  • C
    6% (3)
  • D
    78% (38)

Why each option

A Ping of Death attack sends fragmented ICMP packets that reconstruct to a size exceeding the 65,535-byte IP maximum, causing buffer overflows or crashes on the target.

AFraggle attack

A Fraggle attack is a UDP-based amplification attack that spoofs the victim's IP address and sends UDP echo packets to network broadcast addresses, not oversized fragmented ICMP packets.

BSYN Flood attack

A SYN Flood attack exploits the TCP three-way handshake by sending large volumes of SYN packets without completing connections to exhaust server resources, and does not involve ICMP or oversized packet fragments.

CLand attack

A Land attack sends a TCP SYN packet where the source and destination IP address and port are set to the same value, causing the target to loop on itself, and has nothing to do with oversized ICMP packet reassembly.

DPing of death attackCorrect

The Ping of Death attack exploits the IP protocol maximum packet size of 65,535 bytes by deliberately crafting fragmented ICMP packets that, once reassembled by the target host, exceed this limit and overflow memory buffers. The specific indicators in the question - fragmented ICMP packets and a reconstructed size over 65,536 bytes - are the precise technical signature of this attack, distinguishing it from all other denial-of-service variants.

Concept tested: Ping of Death ICMP fragmentation overflow attack

Source: https://www.cisa.gov/uscert/ncas/tips/ST04-015

Topics

#ping of death#ICMP fragmentation#oversized packets#DoS attack

Community Discussion

No community discussion yet for this question.

Full GCIA Practice