GCIH · Question #826
An analyst notices a large amount of ICMP Time Exceeded packets logged on an outbound firewall interface. What is most likely occurring?
The correct answer is B. Traceroute is being run. Large volumes of outbound ICMP Time Exceeded packets are the expected network signature of a traceroute operation in progress.
Question
An analyst notices a large amount of ICMP Time Exceeded packets logged on an outbound firewall interface. What is most likely occurring?
Options
- AA ping sweep is being run
- BTraceroute is being run
- CDHCP addresses are expiring
- DICMP is blocked by the firewall
How the community answered
(32 responses)- A3% (1)
- B94% (30)
- C3% (1)
Why each option
Large volumes of outbound ICMP Time Exceeded packets are the expected network signature of a traceroute operation in progress.
A ping sweep generates ICMP Echo Request (Type 8) and Echo Reply (Type 0) packets, not ICMP Time Exceeded messages.
Traceroute works by sending packets with incrementally increasing TTL values; each router that decrements the TTL to zero returns an ICMP Time Exceeded (Type 11) message back to the sender. Seeing many such packets on an outbound firewall interface indicates a host inside the network is actively running traceroute toward external destinations, which can signal reconnaissance activity.
DHCP lease expiration is handled by the DHCP protocol over UDP ports 67/68 and has no relationship to ICMP Time Exceeded messages.
If ICMP were blocked by the firewall, the packets would be dropped and logged as denies, not appear as Time Exceeded packets on the outbound interface.
Concept tested: ICMP Time Exceeded packets as traceroute indicator
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/how-traceroute-works
Topics
Community Discussion
No community discussion yet for this question.