GCIH · Question #284
Adam works as a Security administrator for Umbrella Inc. He runs the following traceroute and notices that hops 19 and 20 both show the same IP address. 1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285…
The correct answer is D. A stateful inspection firewall. Consecutive traceroute hops displaying the same IP address is a classic indicator of a stateful inspection firewall silently dropping ICMP TTL-exceeded messages while still forwarding the underlying traffic.
Question
Adam works as a Security administrator for Umbrella Inc. He runs the following traceroute and notices that hops 19 and 20 both show the same IP address. 1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285 ms 0.613 ms 2 ip68-98-176-1.nv.nv.cox.net (68.98.176.1) 12.169 ms 14.958 ms 13.416 ms 3 ip68-98-176-1.nv.nv.cox.net (68.98.176.1) 13.948 ms ip68-100-0-1.nv.nv. cox.net (68.100.0.1) 16.743 ms 16.207 ms 4 ip68- 100-0- 137.nv.nv.cox.net (68.100.0.137) 17.324 ms 13.933 ms 20.938 ms 5 68.1.1.4 (68.1.1.4) 12.439 ms 220.166 ms 204.170 ms 6 so-6-0-0.gar2.wdc1.Level3.net (67.29.170.1) 16.177 ms 25.943 ms 14.104 ms 7 0.bbr1.NewYork1.level3.net (64.159.1.41) 17.063 ms 20.960 ms 19.512 ms 9 so-7-0-0.gar1. NewYork1.Level3.net (64.159.1.182) 20.334 ms 19.440 ms 17.938 ms 10 so-4-0- 0.edge1.NewYork1.Level3. net (209.244.17.74) 27.526 ms 18.317 ms 21.202 ms 11 uunet-level3- oc48.NewYork1.Level3.net (209.244.160.12) 21.411 ms 19.133 ms 18.830 ms 12 0.so-6-0-0.XL1.NYC4.ALTER.NET (152.63.21.78) 21.203 ms 22.670 ms 20.111 ms 13 0.so-2-0-0.TL1.NYC8.ALTER.NET (152.63.0.153) 30.929 ms 24.858 ms 23.108 ms 14 0.so-4-1-0.TL1.ATL5.ALTER.NET (152.63.10.129) 37.894 ms 33.244 ms 33.910 ms 15 0.so-7-0-0.XL1.MIA4.ALTER.NET (152.63.86.189) 51.165 ms 49.935 ms 49.466 ms 16 0.so-3-0-0.XR1.MIA4.ALTER. NET (152.63.101.41) 50.937 ms 49.005 ms 51.055 ms 17 117.ATM6- 0.GW5.MIA1.ALTER.NET Which of the following is the most like cause of this issue?
Options
- AAn application firewall
- BIntrusion Detection System
- CNetwork Intrusion system
- DA stateful inspection firewall
How the community answered
(25 responses)- A16% (4)
- B4% (1)
- C4% (1)
- D76% (19)
Why each option
Consecutive traceroute hops displaying the same IP address is a classic indicator of a stateful inspection firewall silently dropping ICMP TTL-exceeded messages while still forwarding the underlying traffic.
An application firewall inspects Layer 7 payload content and does not respond to ICMP TTL-exceeded messages in a way that produces duplicate IPs in traceroute output.
An IDS passively monitors and generates alerts without injecting or suppressing traffic, so it would not respond to traceroute probes or cause repeated IPs.
A Network IPS can block traffic flows but does not generate ICMP TTL-exceeded responses on behalf of downstream hops, which is the behavior required to produce repeated IPs in a traceroute.
A stateful inspection firewall tracks connection state and can be configured to suppress or drop ICMP TTL-exceeded responses, causing the traceroute to receive a reply from the firewall's IP for multiple successive TTL values, which makes the same address appear for two consecutive hops.
Concept tested: Identifying stateful inspection firewall via traceroute anomaly
Source: https://www.cisco.com/c/en/us/about/security-center/firewalls.html
Topics
Community Discussion
No community discussion yet for this question.