GIAC
GCIH · Question #596
You run a network using the 10.0.0.0/8 address range. You notice a strange increase in traffic coming from one of your DMZ servers one day. You collect a packet trace using Tcpdump, and notice a rapid
The correct answer is D. A SYN Flood. Spoofed SYN packets sent in rapid succession are a good indicator of a SYN Flood attack in
Incident Response & Cyber Kill Chain
Question
You run a network using the 10.0.0.0/8 address range. You notice a strange increase in traffic coming from one of your DMZ servers one day. You collect a packet trace using Tcpdump, and notice a rapidly repeating pattern of traffic that resembles the following output. What kind of attack is your server most likely perpetrating?
Exhibit
Options
- AA Netbus attack
- BA Back Orifice scan
- CA Tribe Flood Network attack
- DA SYN Flood
How the community answered
(29 responses)- A10% (3)
- B3% (1)
- C7% (2)
- D79% (23)
Explanation
Spoofed SYN packets sent in rapid succession are a good indicator of a SYN Flood attack in
Topics
#SYN flood#Tcpdump analysis#DDoS detection#traffic pattern recognition
Community Discussion
No community discussion yet for this question.