GCIH · Question #283
Your network is being flooded by ICMP packets. When you trace them down they come from multiple different IP addresses. What kind of attack is this?
The correct answer is D. DDOS. An ICMP flood originating from multiple distinct source IP addresses is classified as a Distributed Denial of Service attack because the distributed, multi-source nature is the defining characteristic.
Question
Your network is being flooded by ICMP packets. When you trace them down they come from multiple different IP addresses. What kind of attack is this?
Options
- ASyn flood
- BPing storm
- CSmurf attack
- DDDOS
How the community answered
(58 responses)- A3% (2)
- B7% (4)
- C2% (1)
- D88% (51)
Why each option
An ICMP flood originating from multiple distinct source IP addresses is classified as a Distributed Denial of Service attack because the distributed, multi-source nature is the defining characteristic.
A SYN flood targets TCP connection state tables using SYN packets, not ICMP packets, so the protocol used rules it out.
A ping storm describes a high-volume ICMP echo flood typically from a single source, not the multi-source distributed scenario described.
A Smurf attack is a specific DDoS subtype that amplifies traffic by sending spoofed ICMP echo requests to broadcast addresses - the question describes no such amplification or broadcast mechanism.
A DDoS attack is defined by the coordinated use of many distributed source addresses to overwhelm a target; ICMP flooding from multiple different IPs matches this definition exactly, regardless of the specific packet type used.
Concept tested: Identifying DDoS attack from distributed ICMP flood
Source: https://www.cisa.gov/news-events/news/understanding-denial-service-attacks
Topics
Community Discussion
No community discussion yet for this question.