nerdexam
GIAC

GSLC · Question #142

You work as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. You are working as a root user on the Linux operating system. Your company is facing an IP…

The correct answer is C. Despoof. Despoof is the specific Linux tool designed to detect IP spoofing by alerting administrators when incoming packets have forged or invalid source IP addresses.

Security Operations & Incident Response Leadership

Question

You work as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. You are working as a root user on the Linux operating system. Your company is facing an IP spoofing attack. Which of the following tools will you use to get an alert saying that an upcoming IP packet is being spoofed?

Options

  • ADsniff
  • Bethereal
  • CDespoof
  • DNeotrace

How the community answered

(47 responses)
  • A
    4% (2)
  • C
    94% (44)
  • D
    2% (1)

Why each option

Despoof is the specific Linux tool designed to detect IP spoofing by alerting administrators when incoming packets have forged or invalid source IP addresses.

ADsniff

Dsniff is a suite of tools for network auditing and credential sniffing (capturing passwords and sessions), not for detecting or alerting on IP spoofing.

Bethereal

Ethereal (now Wireshark) is a general-purpose network protocol analyzer used for packet capture and inspection; it does not provide automated alerts for spoofed packets.

CDespoofCorrect

Despoof is a dedicated anti-spoofing utility that inspects incoming IP packets and generates alerts when the source address appears to be spoofed - for example, when a packet arrives on an interface but its source address belongs to a network that should not be reachable via that interface. It directly addresses the IP spoofing threat described in the scenario.

DNeotrace

Neotrace is a visual traceroute and network path analysis tool used to map the route packets take to a destination, not to detect IP spoofing attacks.

Concept tested: IP spoofing detection tool on Linux

Source: https://linux.die.net/man/8/despoof

Topics

#IP spoofing#network attack detection#Linux security tools#intrusion detection

Community Discussion

No community discussion yet for this question.

Full GSLC Practice