At a hospital, an analyst must name what carried the exploit bytes. The IP header protocol number is 6, and the payload begins with an HTTP request line. What carried those bytes?
Select an answer to reveal the explanation.
Short Explanation
The manifest names the truck, and the letter in the cargo names what the truck was hauling. You have IP protocol 6, which is TCP, and an HTTP request line in the payload. The trap is answering ICMP, ARP, or a NetFlow template.
Full Explanation
IANA assigns IP protocol number 6 to TCP. An HTTP request line at the start of the payload is application data carried in that TCP segment, so the exploit bytes rode TCP carrying HTTP. Both facts are in the capture: the protocol number and the request line. TCP, named by IP protocol number 6, carrying the HTTP request that holds the exploit bytes is the carrier. ICMP, identified from an echo structure in the payload rather than from IP protocol number 6, is a different IP protocol, and number 6 is not ICMP. ARP, a link-layer hardware-address request, and not a protocol named by IP protocol number 6, resolves hardware addresses on a local link and is not what protocol 6 indicates, nor does this payload begin as an ARP request. A NetFlow template that describes fields in exported flow records and does not carry the original exploit bytes describes how flow records are exported and does not contain the original packet bytes. On the exam, protocol number 6 names TCP only; the HTTP request line is the separate fact that identifies the application, and a clear request line like this is not inferred from the number alone. In operations, record protocol 6 and the request line together, and do not replace this packet with a flow template when someone asks what carried the bytes.