CAPEC-332: ICMP IP 'ID' Field Error Message Probe

攻击模式描述

An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.

前提条件

• The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card.

所需资源

• A tool capable of sending/receiving UDP datagram packets from a remote system to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable."

后果影响