Free Preparation Discussions
MENU
Eccouncil Exam 212-89 Topic 3 Question 68 Discussion
Topic #: 3
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name 'Xmas' comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filter tcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
Emmett
2 months agoStacey
2 months agoRashida
2 months agoGilberto
2 months agoAnnita
2 months agoMarla
9 days agoSharen
12 days agoGenevieve
20 days agoJavier
1 months agoOlive
2 months agoLizette
2 months agoJulieta
1 months agoBarabara
1 months agoMy
2 months agoTeri
2 months agoAdela
1 months agoSean
1 months agoDulce
1 months agoAmie
2 months agoHyman
2 months agoMoon
3 months agoJeannine
2 months agoLonna
2 months agoPauline
2 months agoLetha
3 months ago