Examkin

Question

Difficulty: EasyCommon Network Attack Types and Vectors

A network administrator observes a flood of incoming ICMP Echo Reply packets targeting a key internal server. Investigation reveals that an external attacker sent ICMP Echo Requests to a network broadcast address with the source IP address spoofed to match the target server's IP address. Which type of network attack is taking place?

  1. Smurf attackAnswer
  2. B
    ARP poisoning
  3. C
    DNS amplification attack
  4. D
    SYN flood attack

Answer

Smurf attack
The correct option describes a Smurf attack, which is a legacy form of denial-of-service (DoS) attack where an attacker broadcasts ICMP Echo Requests containing a spoofed source IP belonging to the target host. Every active host receiving the broadcast responds to the target host, creating a massive influx of ICMP Echo Reply traffic.

Step-by-Step Solution

1
Analyze the attack signature described in the scenario
Traffic consists of ICMP Echo Requests sent to a broadcast IP address with a spoofed source IP address.
Identifying the combination of ICMP traffic, IP spoofing, and broadcast addressing reveals the specific amplification mechanism.
2
Match the mechanism to the correct network attack type
The target system is overwhelmed by ICMP Echo Replies from multiple hosts on the network.
This specific technique of using network broadcast addresses to amplify ICMP traffic against a victim defines a Smurf attack.

Key Concept

Common Network Attack Types - Smurf Attack
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic