nerdexam
GIAC

GPEN · Question #429

What is the most likely cause of the responses on lines 10 and 11 of the output below?

The correct answer is D. The devices at hops 10 and II did not return an "ICMP TTL Exceeded in Transit" message.. Asterisks at traceroute hops 10 and 11 indicate those devices did not return ICMP TTL Exceeded in Transit messages to the probing host.

Penetration Testing Foundations & Reconnaissance

Question

What is the most likely cause of the responses on lines 10 and 11 of the output below?

Options

  • AThe device at hop 10 silently drops UDP packets with a high destination port.
  • BThe device at hop 10 is down and not forwarding any requests at all.
  • CThe host running the tracer utility lost its network connection during the scan
  • DThe devices at hops 10 and II did not return an "ICMP TTL Exceeded in Transit" message.

How the community answered

(40 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    13% (5)
  • D
    78% (31)

Why each option

Asterisks at traceroute hops 10 and 11 indicate those devices did not return ICMP TTL Exceeded in Transit messages to the probing host.

AThe device at hop 10 silently drops UDP packets with a high destination port.

Silently dropping UDP packets with a high destination port would affect only that one hop; the fact that both hops 10 and 11 are unresponsive is more consistent with an ICMP response policy than port-specific packet dropping.

BThe device at hop 10 is down and not forwarding any requests at all.

A completely downed device at hop 10 would prevent all packets from being forwarded beyond it, yet the traceroute output shows responses past those hops, meaning packets are routing through but ICMP replies are suppressed.

CThe host running the tracer utility lost its network connection during the scan

A local network connection loss during the scan would cause all remaining subsequent hops to be unresponsive simultaneously, not just the isolated hops 10 and 11 visible in the output.

DThe devices at hops 10 and II did not return an "ICMP TTL Exceeded in Transit" message.Correct

Traceroute works by sending probes with incrementing TTL values and listening for ICMP 'Time Exceeded in Transit' responses from each intermediate hop. When hops 10 and 11 return no response, it means those devices are not generating or forwarding ICMP TTL exceeded messages back to the source - typically due to router configuration, access control lists, or firewall rules that suppress or rate-limit outbound ICMP responses.

Concept tested: Traceroute ICMP TTL Exceeded message filtering and hop non-response

Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tracert

Topics

#traceroute#ICMP TTL#network topology#firewall detection

Community Discussion

No community discussion yet for this question.

Full GPEN Practice