What happens when one experiences a ping of death?
A.
This is when an IP datagram is received with the “protocol” field in the IP header set to 1
(ICMP) and the “type” field in the ICMP header is set to 18 (Address Mask Reply).
B.
This is when an IP datagram is received with the “protocol” field in the IP header set to 1
(ICMP),the Last Fragment bit is set,and (IP offset ‘ 8) + (IP data length) >65535.
In other words,the IP offset (which represents the starting position of this fragment in the original
packet,and which is in 8-byte units) plus the rest of the packet is greater than the maximum size
for an IP packet.
C.
This is when an IP datagram is received with the “protocol” field in the IP header set to 1
(ICMP) and the source equal to destination address.
D.
This is when an the IP header is set to 1 (ICMP) and the “type” field in the ICMP header is set
to 5 (Redirect).
Explanation:
A hacker can send an IP packet to a vulnerable machine such that the lastfragment contains an
offest where (IP offset *8) + (IP data length)>65535.This means that when the packet is
reassembled,its total length is largerthan the legal limit,causing buffer overruns in the machine’s
OS (becousethe buffer sizes are defined only to accomodate the maximum allowed size ofthe
packet based on RFC 791)…IDS can generally recongize such attacks bylooking for packet
fragments that have the IP header’s protocol field set to1 (ICMP),the last bit set,and (IP offset *8)
+(IP data length)>65535″ CCIE Professional Development Network Security Principles and
Practices by Saadat Malik pg 414 “Ping of Death” attacks cause systems to react in an
unpredictable fashion when receiving oversized IP packets. TCP/IP allows for a maximum packet
size of up to 65536 octets (1 octet = 8 bits of data),containing aminimum of 20 octets of IP header
information and zero or more octets ofoptional information,with the rest of the packet being data.
Ping of Deathattacks can cause crashing,freezing,and rebooting.
B
chang