GSLC · Question #142
You work as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. You are working as a root user on the Linux operating system. Your company is facing an IP…
The correct answer is C. Despoof. Despoof is the specific Linux tool designed to detect IP spoofing by alerting administrators when incoming packets have forged or invalid source IP addresses.
Question
You work as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. You are working as a root user on the Linux operating system. Your company is facing an IP spoofing attack. Which of the following tools will you use to get an alert saying that an upcoming IP packet is being spoofed?
Options
- ADsniff
- Bethereal
- CDespoof
- DNeotrace
How the community answered
(47 responses)- A4% (2)
- C94% (44)
- D2% (1)
Why each option
Despoof is the specific Linux tool designed to detect IP spoofing by alerting administrators when incoming packets have forged or invalid source IP addresses.
Dsniff is a suite of tools for network auditing and credential sniffing (capturing passwords and sessions), not for detecting or alerting on IP spoofing.
Ethereal (now Wireshark) is a general-purpose network protocol analyzer used for packet capture and inspection; it does not provide automated alerts for spoofed packets.
Despoof is a dedicated anti-spoofing utility that inspects incoming IP packets and generates alerts when the source address appears to be spoofed - for example, when a packet arrives on an interface but its source address belongs to a network that should not be reachable via that interface. It directly addresses the IP spoofing threat described in the scenario.
Neotrace is a visual traceroute and network path analysis tool used to map the route packets take to a destination, not to detect IP spoofing attacks.
Concept tested: IP spoofing detection tool on Linux
Source: https://linux.die.net/man/8/despoof
Topics
Community Discussion
No community discussion yet for this question.