A PCAP analyst examines a file and sees many TCP packets with the PSH and ACK flags set in a consistent pattern with uniform inter-arrival times. Combined with small, fixed-size payloads, what technique might this indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because uniform inter-arrival times combined with fixed-size payloads in a TCP session can indicate a timing covert channel where the spacing between packets encodes data, or simply structured C2 beaconing with consistent packet intervals. A is wrong because SYN flood attacks send only SYN packets in large volumes, not PSH+ACK packets with payloads.
Full explanation below image
Full Explanation
B is correct because uniform inter-arrival times combined with fixed-size payloads in a TCP session can indicate a timing covert channel where the spacing between packets encodes data, or simply structured C2 beaconing with consistent packet intervals. A is wrong because SYN flood attacks send only SYN packets in large volumes, not PSH+ACK packets with payloads. C is wrong because HTTPS traffic shows variable inter-arrival times and payload sizes due to HTTP/2 multiplexing and TLS record sizes. D is wrong because FTP data transfers show large payload sizes and variable timing, not uniform fixed-size payloads.