nerdexam
GIAC

GCIH · Question #826

An analyst notices a large amount of ICMP Time Exceeded packets logged on an outbound firewall interface. What is most likely occurring?

The correct answer is B. Traceroute is being run. Large volumes of outbound ICMP Time Exceeded packets are the expected network signature of a traceroute operation in progress.

Reconnaissance, Scanning, and Enumeration

Question

An analyst notices a large amount of ICMP Time Exceeded packets logged on an outbound firewall interface. What is most likely occurring?

Options

  • AA ping sweep is being run
  • BTraceroute is being run
  • CDHCP addresses are expiring
  • DICMP is blocked by the firewall

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    94% (30)
  • C
    3% (1)

Why each option

Large volumes of outbound ICMP Time Exceeded packets are the expected network signature of a traceroute operation in progress.

AA ping sweep is being run

A ping sweep generates ICMP Echo Request (Type 8) and Echo Reply (Type 0) packets, not ICMP Time Exceeded messages.

BTraceroute is being runCorrect

Traceroute works by sending packets with incrementally increasing TTL values; each router that decrements the TTL to zero returns an ICMP Time Exceeded (Type 11) message back to the sender. Seeing many such packets on an outbound firewall interface indicates a host inside the network is actively running traceroute toward external destinations, which can signal reconnaissance activity.

CDHCP addresses are expiring

DHCP lease expiration is handled by the DHCP protocol over UDP ports 67/68 and has no relationship to ICMP Time Exceeded messages.

DICMP is blocked by the firewall

If ICMP were blocked by the firewall, the packets would be dropped and logged as denies, not appear as Time Exceeded packets on the outbound interface.

Concept tested: ICMP Time Exceeded packets as traceroute indicator

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/how-traceroute-works

Topics

#ICMP#traceroute#network reconnaissance#packet analysis

Community Discussion

No community discussion yet for this question.

Full GCIH Practice