Jacob finds the following packet dump in his log file
05/20-17.06.45.061034 192.160.13.4.3465 - 172.16.1.101:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seq. 0XA1D954BD Ack. 0x0 Win. 0x400
05/20-17.06.58.685879 192.160.13.4.3466 - 172.16.1.102:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seg. 0XB7C5627D Ack. 0x0 Win. 0x400
What is likely happening?
A) ACK Scan to port 80
B) Snort alerts noticing strange events
C) Sequence numbers are random, indicating custom packets
D) TTL of 44 is too low, this is a firewalk scan

Question

Jacob finds the following packet dump in his log file
05/20-17.06.45.061034 192.160.13.4.3465 -> 172.16.1.101:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seq. 0XA1D954BD Ack. 0x0 Win. 0x400
05/20-17.06.58.685879 192.160.13.4.3466 -> 172.16.1.102:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seg. 0XB7C5627D Ack. 0x0 Win. 0x400
What is likely happening?
A) ACK Scan to port 80
B) Snort alerts noticing strange events
C) Sequence numbers are random, indicating custom packets
D) TTL of 44 is too low, this is a firewalk scan

Quizplus · Accepted Answer

The ACK bit is set, the destination host address is changing and the traffic is aimed for port 80. This is a simple ACK scan looking for live hosts on this segment.

Jacob Finds the Following Packet Dump in His Log File