GPEN · Question #182
What happens when you scan a broadcast IP address of a network? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. It leads to scanning of all the IP addresses on that subnet at the same time. C. It may show smurf DoS attack in the network IDS of the victim. Scanning a broadcast IP address sends probe packets to all hosts on a subnet simultaneously, and the traffic pattern resembles a smurf attack, which network IDS systems are designed to detect.
Question
What happens when you scan a broadcast IP address of a network? Each correct answer represents a complete solution. Choose all that apply.
Options
- AIt leads to scanning of all the IP addresses on that subnet at the same time.
- BIt will show an error in the scanning process.
- CIt may show smurf DoS attack in the network IDS of the victim.
- DScanning of the broadcast IP address cannot be performed.
How the community answered
(47 responses)- A83% (39)
- B11% (5)
- D6% (3)
Why each option
Scanning a broadcast IP address sends probe packets to all hosts on a subnet simultaneously, and the traffic pattern resembles a smurf attack, which network IDS systems are designed to detect.
A broadcast IP address (e.g., 192.168.1.255) is a logical address that represents all hosts on a subnet; sending a packet to it causes all active hosts to receive and potentially respond, effectively scanning the entire subnet in one operation.
Scanning a broadcast address does not inherently produce a scanning tool error; many scanners handle broadcast addresses and return responses from multiple hosts.
A smurf DoS attack works by sending ICMP echo requests to a broadcast address with a spoofed source IP, causing all hosts to reply to the victim - scanning a broadcast address mimics this traffic pattern, and a network IDS may flag it as a smurf attack attempt.
Scanning a broadcast IP address is technically possible and is a known reconnaissance technique, so claiming it cannot be performed is factually incorrect.
Concept tested: Broadcast address scanning and smurf attack detection
Source: https://www.cisa.gov/uscert/ncas/alerts/TA14-013A
Topics
Community Discussion
No community discussion yet for this question.