Free Preparation Discussions
MENU
GIAC Exam GCED Topic 8 Question 45 Discussion
Topic #: 8
A compromised router is reconfigured by an attacker to redirect SMTP email traffic to the attacker's server before sending packets on to their intended destinations. Which IP header value would help expose anomalies in the path outbound SMTP/Port 25 traffic takes compared to outbound packets sent to other ports?
In a case study of a redirect tunnel set up on a router, some anomalies were noticed while watching network traffic with the TCPdump packet sniffer.
Packets going to port 25 (Simple Mail Transfer Protocol [SMTP] used by mail servers and other Mail Transfer Agents [MTAs] to send and receive e-mail) were apparently taking a different network path. The TLs were consistently three less than other destination ports, indicating another three network hops were taken.
Other IP header values listed, such as fragment offset. The acknowledgement number is a TCP, not IP, header field.
Malcolm
4 months agoLaurena
4 months agoSylvia
3 months agoSean
3 months agoRenato
3 months agoPearly
4 months agoSylvia
5 months agoPok
5 months agoOlive
3 months agoCelestina
3 months agoVicki
3 months agoNoemi
3 months agoHubert
3 months agoTasia
3 months agoElly
3 months agoNikita
3 months agoPaulina
3 months agoMargart
3 months agoCarissa
3 months agoRaylene
4 months agoHoward
5 months agoMila
5 months agoJanine
5 months ago