Free Preparation Discussions
MENU
Eccouncil Exam 212-89 Topic 3 Question 68 Discussion
Topic #: 3
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name 'Xmas' comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filter tcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
Emmett
14 days agoStacey
15 days agoRashida
16 days agoGilberto
18 days agoAnnita
19 days agoJavier
7 days agoOlive
26 days agoLizette
27 days agoJulieta
1 days agoBarabara
11 days agoMy
15 days agoTeri
1 months agoSean
1 days agoDulce
7 days agoAmie
1 months agoHyman
1 months agoMoon
2 months agoJeannine
14 days agoLonna
15 days agoPauline
22 days agoLetha
2 months ago