GCIH · Question #348
You are the leader of an incident handling team for a mid-size manufacturer in the United States. Several of your company's products are patented and several processes used in the manufacturing…
The correct answer is A. Set up a host intrusion detection system on the host with the internal IP address. The traffic pattern described - identical IPs and ports but incrementing TTLs - is characteristic of techniques like firewall walking or OS fingerprinting, where an attacker probes a target by systematically adjusting the TTL field to map network topology or discover firewall…
Question
You are the leader of an incident handling team for a mid-size manufacturer in the United States. Several of your company's products are patented and several processes used in the manufacturing process are considered trade secrets. A member of your company's firewall team sent you a tcpdump of a firewall log thought looked suspicious. The packets in question had the same external source IP address, the same internal destination IP addresses, and the same source and destination ports were used in each packet. The only difference between the packets was that the TTL's had been incremented. How can you best determine if this is a sign of something malicious or not?
Options
- ASet up a host intrusion detection system on the host with the internal IP address
- BGather more data from your firewall logs and from other system logs inside your network
- CCheck the Internet Storm Center's Top 10 Source IPs Report to see if the external IP address is
- DRun a protocol analyzer on your computer with a filter that will only show the internal or external
How the community answered
(32 responses)- A50% (16)
- B28% (9)
- C16% (5)
- D6% (2)
Explanation
The traffic pattern described - identical IPs and ports but incrementing TTLs - is characteristic of techniques like firewall walking or OS fingerprinting, where an attacker probes a target by systematically adjusting the TTL field to map network topology or discover firewall rules. The key question is whether these probes are having any effect on the destination host. Installing a Host Intrusion Detection System (HIDS) on the internal destination host is the best choice because it monitors activity at the OS level - system calls, file access, process execution, and network connections - allowing you to determine whether the suspicious traffic is causing any malicious behavior or compromise on that specific machine. Option B (gathering more log data) is useful but passive and indirect. Option C (checking the ISC Top 10) only tells you if the source IP has been reported elsewhere - not whether it's actively harming your host. Option D (running a protocol analyzer on your own computer) would not capture traffic destined for a different internal host.
Topics
Community Discussion
No community discussion yet for this question.