nerdexam
GIAC

GCIH · Question #292

Adam, a malicious hacker purposely sends fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes. On the basis of above information…

The correct answer is B. Ping of death attack. The Ping of Death attack involves sending oversized ICMP packets that exceed the maximum legal IP packet size of 65,535 bytes, causing buffer overflows and system crashes upon reassembly. Sending fragmented ICMP packets that reconstruct to over 65,536 bytes is the defining…

Incident Response & Cyber Kill Chain

Question

Adam, a malicious hacker purposely sends fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes. On the basis of above information, which of the following types of attack is Adam attempting to perform?

Options

  • AFraggle attack
  • BPing of death attack
  • CSYN Flood attack
  • DLand attack

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    93% (27)
  • D
    3% (1)

Why each option

The Ping of Death attack involves sending oversized ICMP packets that exceed the maximum legal IP packet size of 65,535 bytes, causing buffer overflows and system crashes upon reassembly. Sending fragmented ICMP packets that reconstruct to over 65,536 bytes is the defining characteristic of this attack.

AFraggle attack

A Fraggle attack uses UDP packets sent to broadcast addresses to amplify traffic and flood a target, and does not involve oversized ICMP packet fragmentation.

BPing of death attackCorrect

The Ping of Death exploits the fact that while IP packets cannot legally exceed 65,535 bytes, fragmented ICMP packets can be crafted so their reassembled size exceeds this limit, causing a buffer overflow on the target system when it attempts to reassemble the oversized packet.

CSYN Flood attack

A SYN Flood attack exploits the TCP three-way handshake by sending large numbers of SYN requests without completing the connection, and does not involve ICMP packets or packet size manipulation.

DLand attack

A Land attack sends a TCP SYN packet with identical source and destination IP addresses and ports to cause the target to loop, which is unrelated to oversized ICMP fragmentation.

Concept tested: Ping of Death oversized ICMP packet attack

Source: https://www.cloudflare.com/learning/ddos/ping-of-death-ddos-attack/

Topics

#Ping of Death#ICMP fragmentation#oversized packet#DoS attack

Community Discussion

No community discussion yet for this question.

Full GCIH Practice