Which of the following attacks uses return timeout messages with a TTL of 0 to spy on the structure of the target network?

Question

Options

• AHTTP
• BTracert attack
• CUDP
• DICMP redirect attack

• A
  6% (2)
• B
  76% (26)
• C
  3% (1)
• D
  15% (5)

Explanation

Tracert (traceroute) works by sending packets with incrementally increasing TTL values - starting at 1, then 2, 3, and so on. Each router along the path decrements the TTL; when it hits 0, the router drops the packet and returns an ICMP "Time Exceeded" message back to the sender. By collecting these timeout responses, an attacker can reconstruct the full hop-by-hop topology of the target network, making it a passive reconnaissance technique.

Why the distractors are wrong:

• A (HTTP): HTTP is an application-layer web protocol with no TTL manipulation capability; it's used for content transfer, not network mapping.
• C (UDP): UDP is a transport-layer protocol, not an attack technique. While traceroute can use UDP packets as probes (common on Linux), UDP alone isn't the attack - the TTL exploitation mechanism is what defines it.
• D (ICMP redirect attack): This is a different attack where forged ICMP redirect messages trick hosts into rerouting traffic through an attacker's machine - it's about hijacking traffic, not mapping network structure.

Memory tip: Think "Tracert = Trace the Route" - it literally draws a map of the network path by timing out at each hop. If the question mentions TTL = 0 + network topology discovery, that's always traceroute.

No community discussion yet for this question.