The following anomalous network flow was observed while running tcpdump on a firewall protecting DMZ web services on the 192.0.2.0/24 network. What conclusion can be drawn?

The correct answer is B. The system with address 203.0.113.8 has successfully connected to a backdoor on 192.0.2.31. In the traffic flow a successful three way handshake is shown from 203.0.113.8 to 192.0.2.31 on port 5900, the default port for a VNC server. TCP port 5500, not present in the traffic flow, is the default port used to shovel GUI sessions from a server to a waiting client. IP 203.

Incident Response & Cyber Kill Chain

Question

Exhibit

Options

AThe system with address 203.0.113.8 has unsuccessfully performed an ACK scan on 192.0.2.31
BThe system with address 203.0.113.8 has successfully connected to a backdoor on 192.0.2.31
CThe server with address 192.0.2.31 has successfully connected to a backdoor on 203.0.113.8
DThe server with address 192.0.2.31 has successfully shovelled a GUI to 203.0.113.8

How the community answered

(57 responses)

A
7% (4)
B
56% (32)
C
23% (13)
D
14% (8)

Explanation

In the traffic flow a successful three way handshake is shown from 203.0.113.8 to 192.0.2.31 on port 5900, the default port for a VNC server. TCP port 5500, not present in the traffic flow, is the default port used to shovel GUI sessions from a server to a waiting client. IP 203.0.113.8.49710 > 192.0.2.31.5900: Flags [S], seq 179, win 8192, options [mss 1460,nop,nop,sackOK], length 0 IP 192.0.2.31.5900 > 203.0.113.8.49710: Flags [S.], seq 809, ack 180, win 8192, options [mss 1460,nop,nop,sackOK], length 0 IP 203.0.113.8.49710 > 192.0.2.31.5900: Flags [.], ack 1, win 64240, length 0.

Topics

#tcpdump#network flow analysis#backdoor detection#packet analysis

Community Discussion

No community discussion yet for this question.

Full GCIH Practice