Home ExamRange Practice Tests
Welcome to the CND network defense simulation. In this exercise, you will learn to identify core Network Layer maintenance protocols. Recognizing how hosts and routers exchange control and error messages is vital for analyzing network scans and establishing effective firewall rules.

CND (312-38) Network Defense Simulation

Network Scenario

You are reviewing your perimeter firewall and Intrusion Detection System (IDS) alerts. An external IP address is attempting to map your internal network topology.

Your external-facing firewall is configured to block standard "ping" sweeps, but the adversary is utilizing a traceroute technique. By manipulating the Time-To-Live (TTL) values of outbound packets, the attacker forces your network's routers to respond with specific error messages, thereby revealing the router's IP address and the path into your network.

Traffic & Logs

Aggregated Firewall & IDS Logs (Perimeter-FW-01):

[FW-01] DROP: SRC=203.0.113.45 DST=10.0.5.22 PROTO=ICMP TYPE=8 CODE=0 (Echo Request) [IDS-01] ALERT: ET SCAN Potential Traceroute Activity SRC=203.0.113.45 DST=10.0.5.22 PROTO=UDP DPT=33435 [FW-01] PERMIT: SRC=10.0.0.1 (Core-Rtr) DST=203.0.113.45 PROTO=ICMP TYPE=11 CODE=0 (Time Exceeded) [FW-01] PERMIT: SRC=10.0.1.1 (Dist-Rtr) DST=203.0.113.45 PROTO=ICMP TYPE=11 CODE=0 (Time Exceeded) [FW-01] PERMIT: SRC=10.0.5.22 (Host) DST=203.0.113.45 PROTO=ICMP TYPE=3 CODE=3 (Port Unreachable)

Question

Which of the following is a maintenance protocol that permits routers and host computers to swap basic control information when data is sent from one computer to another?
Hint: Look at the logs. The routers and hosts are sending messages like "Time Exceeded" and "Port Unreachable" to communicate errors. These are Types 11 and 3 of the protocol in question.

Expert Analysis

1. What is happening in the network

An external attacker is performing network reconnaissance using traceroute. By sending UDP packets with incrementally increasing Time-To-Live (TTL) values, the attacker forces each successive router in the path to drop the packet and respond with a diagnostic control message (Time Exceeded) back to the sender.

2. Identify the behavior

The network devices are generating error reporting and control messages to inform the sending host about delivery issues. This swapping of basic control information happens at Layer 3 (Network Layer) to maintain operational awareness and handle errors, like unreachable destinations or expired TTLs.

3. Why the correct answer is correct

B. ICMP (Internet Control Message Protocol) is the correct answer. ICMP is a core protocol in the TCP/IP suite used exclusively by network devices (like routers) and hosts to send error messages and operational information indicating, for example, that a requested service is not available or that a host or router could not be reached.

4. Why others are wrong

  • A. IGMP (Internet Group Management Protocol): Used by hosts and adjacent routers on IPv4 networks to establish multicast group memberships, not for general error or control message swapping.
  • C. SNMP (Simple Network Management Protocol): An Application Layer protocol used for collecting and organizing information about managed devices on IP networks (e.g., CPU load, interface status). It is for network management, not basic data transmission control.
  • D. BGP (Border Gateway Protocol): The routing protocol used to exchange routing and reachability information among autonomous systems (AS) on the internet, not host-to-host transmission control.

5. Defensive action

To prevent internal network enumeration, network defenders should configure edge firewalls to block outbound ICMP Type 11 (Time Exceeded) messages. While some ICMP traffic is necessary for Path MTU Discovery (Type 3, Code 4), overly permissive outbound ICMP allows attackers to map internal infrastructure.

6. MINI LESSON:

  • ICMP Types & Codes: Network analysts must memorize critical ICMP signatures. Type 8 (Echo Request) and Type 0 (Echo Reply) are used for ping. Type 3 is Destination Unreachable. Type 11 is Time Exceeded (crucial for traceroute).
  • Covert Channels: ICMP is frequently abused to create covert channels (e.g., ICMP tunneling) or for data exfiltration because many organizations blindly permit outbound ICMP.
  • Defense-in-Depth: Do not just block "ping" (Echo Requests). A comprehensive ICMP filtering policy is required to mask topology while maintaining network health.

Master Network Defense

Sharpen your skills with hundreds of scenario-based CND questions.

Explore more CND simulations