CND (312-38) Network Defense Simulation

In this simulation, you will analyze how the Transmission Control Protocol (TCP) maintains network stability. Learn to identify protocol mechanisms that prevent resource exhaustion and ensure reliable data delivery across complex infrastructures.

Network Scenario

An enterprise backup server (Backup-Srv-01) is initiating a multi-terabyte data synchronization to a remote disaster recovery site. The source server is capable of 10Gbps throughput, but the destination node is currently under heavy CPU load due to localized indexing tasks.

Hosts

• Source: 10.10.50.22 (Backup-Srv-01)
• Destination: 172.16.200.5 (DR-Node-Remote)
• Service: Rsync over SSH (TCP 22)

Observation

• Initial Speed: 850 MB/s
• Current Speed: 45 MB/s
• Pattern: Rapid fluctuations in transfer rate

Traffic & Logs

Packet capture summary from the destination interface:

[14:20:01.442] 10.10.50.22 > 172.16.200.5: Flags [P.], seq 1001:2461, ack 1, win 65535, length 1460
[14:20:01.443] 172.16.200.5 > 10.10.50.22: Flags [.], ack 2461, win 4096, length 0
[14:20:01.445] 10.10.50.22 > 172.16.200.5: Flags [P.], seq 2461:3921, ack 1, win 65535, length 1460
[14:20:01.446] 172.16.200.5 > 10.10.50.22: Flags [.], ack 3921, win 512, length 0
[14:20:01.450] 172.16.200.5 > 10.10.50.22: Flags [.], ack 3921, win 0, length 0 (TCP ZeroWindow)

Question

Which of the following key features used by TCP to regulate the amount of data sent to the host machine to another network?

Expert Analysis

1. What is happening in the network

The destination host (172.16.200.5) is struggling to process the incoming data stream as fast as the source is sending it. In the logs, you can see the win (Window Size) value advertised by the destination decreasing from 4096 to 512, and finally to 0.

2. Identify attack or behavior

This is a standard TCP Flow Control mechanism in action. The TCP ZeroWindow alert is the receiver's way of telling the sender to pause transmission until buffer space becomes available. This is not an attack, but a critical stability feature of the protocol.

3. Why correct answer is correct

Flow control (Option B) is the correct answer. It manages the data rate between two nodes (host to host) to ensure that a fast sender does not overwhelm a slow receiver. It uses the "Window" field in the TCP header to communicate availability.

4. Why others are wrong

Congestion Control: While similar, this regulates data flow to protect the network path and intermediate routers, not specifically the destination host's buffers.
TCP Timestamp: Used for calculating Round Trip Time (RTT) and protecting against wrapped sequence numbers.
SEQ ID NO: Sequence numbers ensure data is reassembled in the correct order but do not regulate throughput rates.

5. Defensive Action

From a defense perspective, continuous ZeroWindow alerts can indicate a "Slowloris" type behavior or a resource exhaustion issue. Defenders should monitor TCP Window utilization. If legitimate, tune the tcp_receive_window and ensure the destination application has sufficient resources to empty the kernel buffers.

Mini Lesson: The Sliding Window

TCP uses a Sliding Window algorithm. The receiver provides a "window size" in every ACK packet. The sender is permitted to send up to that amount of data without waiting for further ACKs. If the window reaches zero, the sender must stop and periodically send "Window Probes" to check for space.

Explore more CND simulations