GSLC · Question #268
Which of the following tools can be used to perform ICMP tunneling? Each correct answer represents a complete solution. Choose two.
The correct answer is C. Itunnel D. Ptunnel. Ptunnel and Itunnel are purpose-built tools that encapsulate arbitrary TCP data inside ICMP echo request and reply packets to tunnel traffic through firewalls.
Question
Which of the following tools can be used to perform ICMP tunneling? Each correct answer represents a complete solution. Choose two.
Options
- AWinTunnel
- BEthereal
- CItunnel
- DPtunnel
How the community answered
(20 responses)- A5% (1)
- C95% (19)
Why each option
Ptunnel and Itunnel are purpose-built tools that encapsulate arbitrary TCP data inside ICMP echo request and reply packets to tunnel traffic through firewalls.
WinTunnel is not a recognized or documented ICMP tunneling tool; it does not perform ICMP encapsulation.
Ethereal (now Wireshark) is a passive packet capture and protocol analysis tool, not a tunneling utility, so it cannot create ICMP tunnels.
Itunnel is an ICMP tunneling utility that encapsulates TCP connections inside ICMP packets, enabling communication through firewalls that permit ICMP but block other protocols.
Ptunnel (Ping Tunnel) uses ICMP echo request and reply messages as a carrier for TCP data, effectively creating a covert tunnel over ICMP through restrictive network perimeters.
Concept tested: ICMP tunneling tools and covert channel techniques
Source: https://www.sans.org/reading-room/whitepapers/covert/icmp-covert-channel-35555
Topics
Community Discussion
No community discussion yet for this question.