During network security monitoring, an analyst observes Zeek logs showing an internal host (192.168.1.50) making ICMP requests to 254 different hosts within the 192.168.1.0/24 subnet within 30 seconds. What does this indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — rapid ICMP echo requests to all 254 hosts in a /24 subnet is a classic ping sweep for host discovery, often used by attackers or malware doing reconnaissance after initial compromise. Legitimate monitoring tools target known, documented IPs, not the whole subnet in 30 seconds.
Full Explanation
The correct indication is an ICMP ping sweep: the host is scanning the subnet to discover live hosts, which is indicative of network reconnaissance by malware or an attacker. Sending ICMP echo requests to all 254 hosts in a /24 subnet in rapid succession is a classic ping sweep for host discovery, used by attackers and malware performing reconnaissance after initial compromise. The normal ICMP keepalive traffic from a network monitoring system is wrong because legitimate network monitoring tools have known IP addresses, are configured with specific targets, and are documented in the network baseline. The routing protocol broadcasting ICMP hello messages to discover neighbors is wrong because routing protocols use protocol-specific multicast addresses and their own hello mechanisms, not subnet-wide ICMP pings. The host's ARP cache refreshing by sending ICMP to all known hosts is wrong because ARP handles Layer 2 address resolution; ICMP is not used for ARP cache refresh.