nerdexam
GIAC

GSLC · Question #53

You discover that all available network bandwidth is being used by some unknown service. You discover that UDP packets are being used to connect the echo service on one machine to the chargen…

The correct answer is B. Denial of Service. Connecting the UDP echo service on one host to the chargen service on another creates a self-sustaining traffic loop that exhausts all available bandwidth, which is a Denial of Service attack.

Security Operations & Incident Response Leadership

Question

You discover that all available network bandwidth is being used by some unknown service. You discover that UDP packets are being used to connect the echo service on one machine to the chargen service on another machine. What kind of attack is this?

Options

  • ASmurf
  • BDenial of Service
  • CVirus
  • DEvil Twin

How the community answered

(31 responses)
  • A
    16% (5)
  • B
    74% (23)
  • C
    3% (1)
  • D
    6% (2)

Why each option

Connecting the UDP echo service on one host to the chargen service on another creates a self-sustaining traffic loop that exhausts all available bandwidth, which is a Denial of Service attack.

ASmurf

A Smurf attack works by sending ICMP echo requests to a broadcast address with a spoofed victim source IP, causing many hosts to flood the victim, not by exploiting the UDP echo-chargen relationship.

BDenial of ServiceCorrect

The UDP echo service reflects all received data back to its sender, while the chargen service continuously generates and streams character data. An attacker forges the source address of a UDP packet so that echo and chargen keep feeding each other, producing a traffic amplification loop that saturates network bandwidth and denies service to legitimate users - a textbook network-layer Denial of Service condition.

CVirus

A virus is self-replicating malicious code that infects host files or systems, not a network protocol exploitation technique targeting UDP services.

DEvil Twin

An Evil Twin is a rogue wireless access point that impersonates a legitimate AP to intercept wireless traffic, completely unrelated to UDP service abuse.

Concept tested: UDP echo-chargen DoS attack mechanism

Source: https://www.cisa.gov/news-events/alerts/1997/02/07/chargen-denial-service-attack

Topics

#DoS attack#UDP flood#chargen echo exploit#network attack identification

Community Discussion

No community discussion yet for this question.

Full GSLC Practice