200-201 Question 263
Single answerYou are analyzing a PCAP file and notice a series of TCP packets where one host is sending a large number of SYN packets to multiple destination IP addresses without completing the handshake. Based on this observation, what key element of the intrusion can you identify?
- A
A SYN flood attack is occurring, indicating a potential DoS attempt.
- B
The intrusion indicates normal TCP handshake behavior with no malicious activity.
- C
The packets suggest DNS exfiltration activity using covert channels.
- D
The PCAP file shows an ARP spoofing attack targeting the local network.
Show answer and explanation
Correct answer: A
Explanation
The observed behavior of numerous SYN packets without completing the handshake is a classic indicator of a SYN flood attack, which is used to overwhelm a target's resources and potentially cause a Denial-of-Service (DoS). Understanding such patterns in a PCAP file is crucial for identifying and mitigating network intrusions.
- A. Correct.
A SYN flood attack is a type of Denial-of-Service (DoS) attack where an attacker sends numerous SYN packets without completing the TCP handshake, overwhelming the target system.
- B. Incorrect.
Normal TCP handshake behavior involves SYN, SYN-ACK, and ACK packets in sequence. The observed packets do not complete the handshake, indicating malicious activity.
- C. Incorrect.
DNS exfiltration typically involves DNS queries and responses, not TCP SYN packets. The observed behavior does not match DNS exfiltration patterns.
- D. Incorrect.
ARP spoofing involves manipulating ARP tables to intercept traffic, which is unrelated to the TCP SYN flooding behavior observed in the PCAP file.