Free Preparation Discussions
MENU
Eccouncil Exam 212-89 Topic 3 Question 68 Discussion
Topic #: 3
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name 'Xmas' comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filter tcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
Pamella
3 days agoEmmett
12 months agoStacey
12 months agoRashida
12 months agoGilberto
12 months agoAnnita
12 months agoMarla
10 months agoSharen
10 months agoGenevieve
11 months agoJavier
11 months agoOlive
12 months agoLizette
12 months agoJulieta
11 months agoBarabara
11 months agoMy
12 months agoTeri
1 years agoAdela
11 months agoSean
11 months agoDulce
11 months agoAmie
1 years agoHyman
1 years agoMoon
1 years agoJeannine
12 months agoLonna
12 months agoPauline
12 months agoLetha
1 years ago