Stream comparison used as a Traceback technique focuses on what two factors?

Question

Options

• Athe IP address and victim port
• Bthe packet contents and audit logs
• Cinter-packet timing and the victim port
• Dthe packet contents and inter-packet timing

• A
  5% (1)
• B
  14% (3)
• C
  5% (1)
• D
  76% (16)

Explanation

Stream comparison (also called thumbprinting) is a traceback technique that identifies attack paths through stepping-stone hosts by correlating streams at different network points. It does this using packet contents - the actual payload data within packets - and inter-packet timing - the intervals between successive packets. These two factors together create a unique "fingerprint" of a stream that persists even as traffic relays through intermediate hosts, allowing analysts to link an attacker's stream to a victim's stream.

Why the distractors fail:

• A (IP address + victim port): IP addresses can be spoofed and are the target of traceback, not the tool; port alone adds no stream identity.
• B (packet contents + audit logs): Audit logs are an offline forensic resource, not a real-time stream comparison factor.
• C (inter-packet timing + victim port): Timing alone is half right, but the victim port is not a distinguishing feature - many unrelated streams share the same destination port.

Memory tip: Think of a stream like a song - you recognize it by the lyrics (packet contents) and the rhythm (inter-packet timing). Both must match to confirm it's the same song playing on different speakers.

No community discussion yet for this question.