An nmap command that includes the host specification of 202.176.56-57.* will scan____ number of hosts.
Answer(s): C
The hosts with IP address 202.176.56.0-255 & 202.176.56.0-255 will be scanned (256+256=512)
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites.77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?
Answer(s): B
Which of the following commands runs snort in packet logger mode?
Note: If you want to store the packages in binary mode for later analysis use./snort-l./log -b
Which of the following command line switch would you use for OS detection in Nmap?
OS DETECTION: -O: Enable OS detection (try 2nd generation w/fallback to 1st) - O2: Only use the new OS detection system (no fallback) -O1: Only use the old (1st generation) OS detection system --osscan-limit: Limit OS detection to promising targets --osscan-guess: Guess OS more aggressively
You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response. Why does the host respond to hping2 and not ping packet?[ceh]# ping 10.2.3.4PING 10.2.3.4 (10.2.3.4) from 10.2.3.80 : 56(84) bytes of data.--- 10.2.3.4 ping statistics ---3 packets transmitted, 0 packets received, 100% packet loss[ceh]# ./hping2 -c 4 -n -i 2 10.2.3.4HPING 10.2.3.4 (eth0 10.2.3.4): NO FLAGS are set, 40 headers + 0 data bytes len=46 ip=10.2.3.4 flags=RA seq=0 ttl=128 id=54167 win=0 rtt=0.8 ms len=46 ip=10.2.3.4 flags=RA seq=1 ttl=128 id=54935 win=0 rtt=0.7 ms len=46 ip=10.2.3.4 flags=RA seq=2 ttl=128 id=55447 win=0 rtt=0.7 ms len=46 ip=10.2.3.4 flags=RA seq=3 ttl=128 id=55959 win=0 rtt=0.7 ms--- 10.2.3.4 hping statistic ---4 packets tramitted, 4 packets received, 0% packet loss round-trip min/avg/max = 0.7/0.8/0.8 ms
Default protocol is TCP, by default hping2 will send tcp headers to target host's port 0 with a winsize of 64 without any tcp flag on. Often this is the best way to do an 'hide ping', useful when target is behind a firewall that drop ICMP. Moreover a tcp null-flag to port 0 has a good probability of not being logged.
Post your Comments and Discuss EC-Council 312-50 exam dumps with other Community members:
Bob Commented on May 19, 2025 Is this relevant in 2025? UNITED KINGDOM
Comeru Commented on December 04, 2024 You pass this exam with these questions. But you need to get the full version. UNITED STATES
ribrahim Commented on June 29, 2023 Done the purchase downloaded successfully thanks! SINGAPORE
Drew Commented on March 08, 2018 need step 3 download activated UNITED STATES
Josh Commented on September 18, 2017 Just paid for it ... seamless experience ... looking forward to using the program to study for the CEH and pass it with flying colors! UNITED STATES