During network security monitoring, an analyst observes Zeek logs showing an internal host (192.168.1.50) making ICMP requests to 254 different hosts within the 192.168.1.0/24 subnet within 30 seconds. What does this indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because sending ICMP echo requests to all 254 hosts in a /24 subnet in rapid succession is a classic ping sweep for host discovery, used by attackers and malware performing reconnaissance after initial compromise. A is wrong because legitimate network monitoring tools have known IP addresses, are configured with specific targets, and are documented in the network baseline.
Full explanation below image
Full Explanation
B is correct because sending ICMP echo requests to all 254 hosts in a /24 subnet in rapid succession is a classic ping sweep for host discovery, used by attackers and malware performing reconnaissance after initial compromise. A is wrong because legitimate network monitoring tools have known IP addresses, are configured with specific targets, and are documented in the network baseline. C is wrong because routing protocols use protocol-specific multicast addresses and their own hello mechanisms, not subnet-wide ICMP pings. D is wrong because ARP handles Layer 2 address resolution; ICMP is not used for ARP cache refresh.