nerdexam
GIAC

GCIH · Question #236

Which of the following protocol loggers is used to detect ping sweep?

The correct answer is D. ippl. The IP Protocols Logger (ippl) is a Linux-based protocol logging daemon that logs ICMP, TCP, and UDP packets, making it capable of detecting ping sweep activity.

Reconnaissance, Scanning, and Enumeration

Question

Which of the following protocol loggers is used to detect ping sweep?

Options

  • Alppi
  • Bpitl
  • Cdpsl
  • Dippl

How the community answered

(41 responses)
  • A
    2% (1)
  • B
    10% (4)
  • C
    2% (1)
  • D
    85% (35)

Why each option

The IP Protocols Logger (ippl) is a Linux-based protocol logging daemon that logs ICMP, TCP, and UDP packets, making it capable of detecting ping sweep activity.

Alppi

lppi is not a recognized protocol logger acronym in standard network security tooling and does not correspond to any known logging utility for detecting ping sweeps.

Bpitl

pitl is not a recognized protocol logger and does not correspond to any documented tool used for detecting ICMP or ping sweep activity.

Cdpsl

dpsl is not a recognized protocol logger acronym and does not correspond to any standard tool used for logging IP protocol traffic or detecting ping sweeps.

DipplCorrect

ippl (IP Protocols Logger) is a Unix/Linux daemon that logs incoming IP protocol connections and packets, including ICMP echo requests used in ping sweeps. Because it captures and logs ICMP traffic at the protocol level, security administrators can analyze its logs to detect systematic ICMP-based ping sweep activity. It is specifically designed to log low-level protocol activity that other application-layer loggers may miss.

Concept tested: ippl protocol logger for ping sweep detection

Source: http://ojnk.sourceforge.net/

Topics

#ippl#ping sweep detection#protocol logging#intrusion detection

Community Discussion

No community discussion yet for this question.

Full GCIH Practice