nerdexam
GIAC

GSLC · Question #268

Which of the following tools can be used to perform ICMP tunneling? Each correct answer represents a complete solution. Choose two.

The correct answer is C. Itunnel D. Ptunnel. Ptunnel and Itunnel are purpose-built tools that encapsulate arbitrary TCP data inside ICMP echo request and reply packets to tunnel traffic through firewalls.

Security Architecture & Engineering

Question

Which of the following tools can be used to perform ICMP tunneling? Each correct answer represents a complete solution. Choose two.

Options

  • AWinTunnel
  • BEthereal
  • CItunnel
  • DPtunnel

How the community answered

(20 responses)
  • A
    5% (1)
  • C
    95% (19)

Why each option

Ptunnel and Itunnel are purpose-built tools that encapsulate arbitrary TCP data inside ICMP echo request and reply packets to tunnel traffic through firewalls.

AWinTunnel

WinTunnel is not a recognized or documented ICMP tunneling tool; it does not perform ICMP encapsulation.

BEthereal

Ethereal (now Wireshark) is a passive packet capture and protocol analysis tool, not a tunneling utility, so it cannot create ICMP tunnels.

CItunnelCorrect

Itunnel is an ICMP tunneling utility that encapsulates TCP connections inside ICMP packets, enabling communication through firewalls that permit ICMP but block other protocols.

DPtunnelCorrect

Ptunnel (Ping Tunnel) uses ICMP echo request and reply messages as a carrier for TCP data, effectively creating a covert tunnel over ICMP through restrictive network perimeters.

Concept tested: ICMP tunneling tools and covert channel techniques

Source: https://www.sans.org/reading-room/whitepapers/covert/icmp-covert-channel-35555

Topics

#ICMP tunneling#covert channels#Ptunnel#Itunnel

Community Discussion

No community discussion yet for this question.

Full GSLC Practice