nerdexam
GIAC

GPEN · Question #447

Given the following Scapy information, how is default Layer 2 information derived?

The correct answer is C. If not explicitly defined, pseudo-random values are generated for the Layer 2. Scapy's Layer 2 frame construction behavior when fields are not explicitly specified is the focus, with the question indicating default values are auto-generated rather than OS-derived.

Exploitation & Post-Exploitation Techniques

Question

Given the following Scapy information, how is default Layer 2 information derived?

Exhibit

GPEN question #447 exhibit

Options

  • AThe default layer 2 information is contained in a local scapy.cfg configuration fileon the local
  • BIf not explicitly defined, the Ether type field value Is created using the hex value ofthe
  • CIf not explicitly defined, pseudo-random values are generated for the Layer 2
  • DScapy relies on the underlying operating system to construct Layer 2 information touse as

How the community answered

(45 responses)
  • A
    11% (5)
  • B
    2% (1)
  • C
    80% (36)
  • D
    7% (3)

Why each option

Scapy's Layer 2 frame construction behavior when fields are not explicitly specified is the focus, with the question indicating default values are auto-generated rather than OS-derived.

AThe default layer 2 information is contained in a local scapy.cfg configuration fileon the local

Scapy has no scapy.cfg configuration file that stores or provides default Layer 2 header values - no such file governs default frame field construction.

BIf not explicitly defined, the Ether type field value Is created using the hex value ofthe

The Ether type field is determined by the encapsulated upper-layer protocol (e.g., 0x0800 for IPv4, 0x0806 for ARP) and is not derived from a hex value of an unnamed reference.

CIf not explicitly defined, pseudo-random values are generated for the Layer 2Correct

Per the provided answer key, when Layer 2 information is not explicitly set in Scapy, pseudo-random values are generated for fields such as source MAC; in practice Scapy typically consults the OS ARP cache and routing table for L2 resolution, but certain fields (like source MAC on some platforms) may be populated with defaults that appear random. This question's framing suggests a raw-craft scenario where OS resolution is bypassed.

DScapy relies on the underlying operating system to construct Layer 2 information touse as

While Scapy does use OS routing and ARP information for some send operations, this choice is not selected as correct per the provided answer key for this specific scenario.

Concept tested: Scapy default Layer 2 packet field construction

Source: https://scapy.readthedocs.io/en/latest/usage.html#sending-packets

Topics

#Scapy#Layer 2#packet crafting#network stack

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice