In this simulation, you will analyze network traffic to detect reconnaissance activities. Understanding how to filter and identify anomalous TCP flag combinations is essential for spotting stealth scanning attempts.

CND (312-38) Network Defense Simulation

Network Scenario

You are a network administrator monitoring edge traffic using Wireshark via a span port off the main firewall. You suspect a threat actor is probing the external-facing web server (192.168.50.80) to bypass standard firewall logging by using packets that do not conform to standard TCP handshakes.

You need to write a Wireshark display filter to identify packets involved in a "Null scan" against the web server.

Traffic & Logs

[WIRESHARK PCAP SNIPPET] 10:15:01.222914 IP 192.168.50.12.54122 > 192.168.50.80.443: Flags [S], seq 481928, win 64240, length 0 10:15:01.223120 IP 203.0.113.45.44211 > 192.168.50.80.80: Flags [none], seq 123456789, win 1024, length 0 <-- SUSPICIOUS 10:15:01.223541 IP 192.168.50.80.443 > 192.168.50.12.54122: Flags [S.], seq 891231, ack 481929, win 64240, length 0 --- [IDS ALERT] [TIMESTAMP] 2023-10-24T10:15:01Z [SOURCE] 203.0.113.45 [DESTINATION] 192.168.50.80 [INFO] Low Severity: TCP Null Scan Detected. No TCP Control Flags Set.

Question

Sam, a network administrator, is using Wireshark to monitor the network traffic of the organization. He wants to detect TCP packets with no flag set to check for a specific attack attempt. Which filter will he use to view the traffic?
A. tcp.flags==0x000
B. tcp.flags==x0000
C. tcp.flags==000x0
D. tcp.flags==0000x

Expert Analysis

1. What is happening in the network: The packet capture snippet shows an external IP address (203.0.113.45) sending a TCP packet to the internal web server with Flags [none]. This means the URG, ACK, PSH, RST, SYN, and FIN flags are all cleared.

2. Identify attack or behavior: This is a TCP Null Scan. Attackers use this reconnaissance technique to determine if ports are open or closed while attempting to bypass stateless firewalls and logging mechanisms that only inspect SYN or ACK flags.

3. Why correct answer is correct: A. tcp.flags==0x000 is the correct display filter syntax. Wireshark uses the 0x prefix to denote hexadecimal values. When no flags are set, the TCP flags field value is mathematically 0. Therefore, 0x000 isolates packets matching this anomaly.

4. Why others are wrong: Options B (x0000), C (000x0), and D (0000x) use incorrect syntax. The Wireshark display filter engine requires the standard hexadecimal prefix 0x at the beginning of the value string. Using the other formats will result in a syntax error.

5. Defensive Action: Network defenders should configure edge firewalls and IPS devices to drop incoming TCP packets that contain invalid flag combinations (such as all flags set to zero, or SYN+FIN). Enforcing stateful inspection ensures that only valid initial SYN packets or packets belonging to an established session state are permitted.

MINI LESSON: TCP Scanning Signatures
  • Null Scan (0x000): No flags are set. Relies on the target sending a RST if closed, or no response if open/filtered.
  • XMAS Scan (0x029): FIN, PSH, and URG flags are set. "Lit up like a Christmas tree."
  • FIN Scan (0x001): Only the FIN flag is set, mimicking a closed connection attempt without a prior state.
  • Detection vs Prevention: While IDS detects these anomalous flags, a correctly configured stateful firewall naturally prevents them by dropping packets without an associated state table entry.

Ready for more CND challenges?

Explore more CND simulations