Larry notices in his log file that a lot of TCP traffic with the UPF flags set are targeting various internal hosts on port 31337. He suspects this traffic is unusual but does not quite know what to make of it. Knowing you just passed your CEH exam, Larry decides to ask what you think.
What would be a possible conclusion?
A) UPF scans are common license tracking mechanisms and should always be ignored. The port belongs to an old tool no one uses anymore and therefore poses no threat.
B) Larry should download the 27001 spec and pour through it word for word until it tells him what to do
C) Larry should run "Zombie P0wn3r" a tool he got from the last Defcon security conference he attended that was guaranteed to wipe out all malicious servers.
D) The traffic is being sent from a tool, and based on port 31337, the assumption could be this is this is a Back Orifice scan.

Question

Quizplus · Accepted Answer

The URG,PSH,FIN flags all set at once look like an Xmas scan. Regardless of what sent it, this combination would not happen during natural protocol behavior and is therefore created by a hacking tool.

Larry Notices in His Log File That a Lot of TCP