Exam 312-49v10 topic 1 question 197 discussion

(A) ✅ The command sends oversized packets (data length 6600) to test router handling. (B) ❌ Undersized packets are not specified in this command. (C) ❌ WLAN handling isn't relevant; the command targets a router. (D) ❌ Fragmentation isn't involved; the command specifies oversized packet size directly. You see, the router "handles" oversized packets by fragmenting them. Routers can fragment IPv4 packets, but this command tests the router's initial handling of oversized packets, not specifically its fragmentation capability. The large data_length creates packets exceeding typical MTU, focusing on how the router manages these oversized packets BEFORE potential fragmentation occurs. ----- If you agree, please UPVOTE. Each time you upvote someone with a yellow "SELECTED ANSWER: " banner (like me) your vote is added to the Community Vote Distribution, which helps the community by crowdsourcing correct answers.

The correct answer is D. Test the ability of a router to handle fragmented packets. The command uses the nmap tool to perform a scan with the following options: -v: increases verbosity -sS: performs a SYN scan (half-open TCP connection) -Po: disables ping scans and OS detection <ip>: specifies the target IP address --data_length 6600: sets the packet size to 6600 bytes, which is larger than the standard MTU (Maximum Transmission Unit) of 1500 bytes, forcing packet fragmentation --packet_trace: enables packet tracing By setting the data length to 6600 bytes, the scan will send packets that need to be fragmented, allowing you to test the router's ability to handle fragmented packets.

There are only two nmap commands referenced in CHFI v10 manual pg. 495-496. nmap -sU and nmap -sT. For what it's worth, an nmap command like this isn't even tested on CEH.