Chapter 3 – Network Traffic Signatures
TRUE/FALSE
1. All devices interpret attack signatures uniformly.
2. An atomic attack is a barrage of hundreds of packets directed at a host.
3. The signature of a normal FTP connection includes a three-way handshake.
4. Newer Trojans listen at a predetermined port on the target computer so that detection is more difficult.
5. Packet fragmentation is not normal, and can only occur if an attack has been initiated.
MULTIPLE CHOICE
1. How does the CVE standard make network security devices and tools more effective?
a.
the layered approach makes attacks nearly
impossible
c.
it requires you to use compatible devices
from one vendor
b.
they can share information about attack
signatures
d.
it warns an attacker that your site is being
monitored
2. Which of the following is NOT among the items of information that a CVE reference reports?
a.
attack signature
c.
description of vulnerability
b.
name of the vulnerability
d.
reference in other databases
3. Which of the following is an accurate set of characteristics you would find in an attack signature?
a.
IP address, attacker’s alias, UDP options
c.
IP address, TCP flags, port numbers
b.
protocol options, TCP ports, region of
origin
d.
IP number, MAC address, TCP options
4. What is the term used when an IDPS doesn’t recognize that an attack is underway?
a.
false negative
c.
negative activity
b.
true positive
d.
positive signature
5. Which of the following is NOT a category of suspicious TCP/IP packet?
a.
bad header information
c.
suspicious data payload
b.
single-packet attacks
d.
suspicious CRC value
6. What can an IDPS check to try to determine whether a packet has been tampered with or damaged in
transit?
a.
parity bit
c.
checksum
b.
CRC value
d.
fragment offset
7. What type of attack does a remote-access Trojan attempt to perpetrate?
a.
worm
c.
remote denial of service
b.
back door
d.
composite attack
8. Under which attack category does a UNIX Sendmail exploitation fall?
a.
bad header information
c.
multiple-packet attack
b.
single-packet attack
d.
suspicious data payload
9. Of what category of attack is a DoS attack an example?
a.
bad header information
c.
multiple-packet attack
b.
single-packet attack
d.
suspicious data payload
10. Which element of an ICMP header would indicate that the packet is an ICMP echo request message.
a.
Code
c.
Identifier
b.
Type
d.
Data
11. Which of the following is an element of the TCP header that can indicate that a connection has been
established?
a.
Flags
c.
SEQ/ACK analysis
b.
Stream index
d.
Sequence number
12. Which TCP flag can be the default response to a probe on a closed port?
a.
RST
c.
PSH
b.
URG
d.
SYN
13. What is the typical packet sequence for closing a TCP session?
a.
FIN, FIN ACK, RST
c.
FIN ACK, FIN, ACK, RST
b.
FIN, ACK, FIN ACK, ACK
d.
FIN, FIN ACK
14. What is the sequence of packets for a successful three-way handshake?
a.
SYN, ACK, ACK
c.
SYN, SYN ACK, ACK
b.
SYN, SYN ACK, RST
d.
SYN, ACK, FIN
15. Which of the following correctly represents the port used by FTP control traffic and FTP file transfer
traffic respectively?
a.
20, 25
c.
20, 23
b.
21, 23
d.
21, 20
16. What is the packet called where a Web browser sends a request to the Web server for Web page data?
a.
HTML SEND
c.
HTTP GET
b.
HTTP XFER
d.
HTML RELAY
17. Under which suspicious traffic signature category would a port scan fall?
a.
informational
c.
denial of service
b.
reconnaissance
d.
unauthorized access
18. In which type of scan does an attacker scan only ports that are commonly used by specific programs?
a.
random scan
c.
ping sweep
b.
vanilla scan
d.
strobe scan
19. Which type of scan has the FIN, PSH, and URG flags set?
a.
Xmas scan
c.
FIN scan
b.
Null scan
d.
SYN Scan
20. Which of the following is the description of a land attack?
a.
the local host source address occurs in the
packet
c.
an illegal TCP flag is found in the segment
header
b.
source and destination IP address/port are
the same
d.
the attacker uses an undefined protocol
number
COMPLETION
1. A ______________ is made up of IP numbers and options, TCP flags, and port number that define a
type of network activity.
2. The _______________ part of a packet is the actual data sent from an application on one computer to
an application on another.
3. In the three-way handshake, the first packet in the sequence has the ________ flag set.
4. A TCP packet with no flags set is referred to as a _________ packet.
5. In an RPC _________, a targeted host receives an RPC set request from a source IP address of
127.0.0.1.
MATCHING
a.
back door
f.
signature
b.
MTU
g.
vanilla scan
c.
ping sweep
h.
RPC
d.
scan throttling
i.
FIN packet
e.
packet injection
j.
RST packet
1. crafted packets that are inserted into network traffic
2. lets the other computer know it is finished sending data
3. an undocumented hidden opening through which an attacker can access a computer
4. a set of characteristics that define a type of network activity
5. used by attackers to delay the progression of a scan
6. a standard set of communications rules that allows one computer to request a service from another
computer
7. sent when one computer want to stop and restart the connection
8. the maximum packet size that can be transmitted
9. all ports from 0 to 65,535 are probed one after another
10. a series of ICMP echo request packets in a range of IP addresses
SHORT ANSWER
1. Describe the purpose of the CVE and how it works.
2. What is signature analysis?
3. What is a multiple-packet attack and what is needed by an IDPS to detect one? Provide an example.
4. Describe the SYN flag and how it is used in the three-way handshake.
5. What is a selective acknowledgement and how does it affect transmissions?
6. Describe in detail the first three packets you would see in an FTP session between client 192.168.1.132
and server 192.168.1.110; include port numbers, flags, and any other pertinent options that would be
set.
7. List the four categories of suspicious traffic categories.
8. What is the difference between a vanilla port scan and a strobe port scan?
9. What are the signatures of malformed packets that misuse the SYN and FIN flags? Briefly describe
each.
10. What is the result of packets that are created which exceed the MTU of the network? How can this
process be exploited?