nerdexam
GIAC

GPEN · Question #482

Analyze the excerpt from a packet capture between the hosts 192.168.116.9 and 192.168.116.101. What factual conclusion can the tester draw from this output?

The correct answer is C. Ports 139 and 135 are open. A packet capture showing TCP SYN packets receiving SYN-ACK replies on both ports 135 and 139 confirms that both ports are actively open and accepting connections on the target host.

Vulnerability Discovery & Scanning

Question

Analyze the excerpt from a packet capture between the hosts 192.168.116.9 and 192.168.116.101. What factual conclusion can the tester draw from this output?

Exhibit

GPEN question #482 exhibit

Options

  • APort 135 is filtered, port 139 is open.
  • BPons 135 and 139 are filtered.
  • CPorts 139 and 135 are open.
  • DPort 139 is closed, port 135 is open

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    83% (30)
  • D
    6% (2)

Why each option

A packet capture showing TCP SYN packets receiving SYN-ACK replies on both ports 135 and 139 confirms that both ports are actively open and accepting connections on the target host.

APort 135 is filtered, port 139 is open.

A filtered port produces no response (the SYN is silently dropped), while an open port returns SYN-ACK; the capture does not show the asymmetric pattern of one filtered and one open port.

BPons 135 and 139 are filtered.

Filtered ports are identified by the complete absence of any reply to a SYN probe; if both ports were filtered the capture would show no responses, contradicting the observable data.

CPorts 139 and 135 are open.Correct

In a TCP port scan visible in a packet capture, an open port is identified by a SYN-ACK response to the scanner's SYN packet, indicating the target is actively listening. If both ports 135 and 139 show SYN-ACK replies, both are open. A closed port returns RST-ACK, and a filtered port produces no reply at all.

DPort 139 is closed, port 135 is open

A closed port returns a RST-ACK packet in response to a SYN probe; the capture does not show RST-ACK behavior for port 139, so it cannot be concluded that port 139 is closed.

Concept tested: TCP port state identification from packet capture analysis

Source: https://nmap.org/book/man-port-scanning-basics.html

Topics

#packet capture#port state analysis#TCP handshake#network scanning

Community Discussion

No community discussion yet for this question.

Full GPEN Practice