Identifying Ping of Death via Oversized ICMP Packets
Short answer
B The investigator is seeing a Ping of Death attack characterized by ICMP packets exceeding the 65,536-byte limit.
Question
Key Takeaways
The exam tests knowledge of legacy DoS techniques; the common trap is confusing large ICMP floods (Smurf/Fraggle) with malformed oversized packets designed to crash systems.
This question tests the ability to identify network attacks by analyzing packet characteristics in firewall logs. The presence of ICMP packets exceeding the maximum IP payload size is a definitive indicator of a Ping of Death attack.
Common mistake: Candidates often select Smurf or Fraggle, which involve amplification and broadcast forwarding rather than sending individual massive packets that exceed protocol limits.
Expert Analysis
Why the Answer Is Correct
The correct answer is B because the Ping of Death (PoD) is a specific denial-of-service attack that exploits the TCP/IP specification by sending ping packets larger than the maximum allowed size of 65,535 bytes (often cited as >65,536). When the target system receives these malformed packets, it fails to reassemble them correctly, leading to a system crash or freeze.
Why the Other Options Are Wrong
Smurf (A) and Fraggle (C) are amplification attacks that use ICMP or UDP broadcasts to flood a target, but they rely on volume and spoofing, not necessarily oversized single packets. An Nmap scan (D) typically uses small, standard-sized probes for discovery and does not inherently involve sending massive ICMP fragments.
Community Comment Notes
The community consensus strongly supports option B, with users noting that ICMP packets larger than 65,536 bytes are indicative of this specific legacy attack. As one user paraphrased, this involves "malformed or malicious ICMP packets" that cause instability, confirming the definition of PoD.
Official Reference
https://www.cloudflare.com/learning/ddos/ping-of-death-ddos-attack/
This link opens the official vendor documentation in a new tab.
Exam Strategy
Focus on the technical constraints of protocols; knowing that IPv4 headers have a 16-bit length field (max ~65k) helps you instantly rule out normal traffic when seeing values above that threshold.
Frequently Asked Questions
Why isn't this a Smurf attack?
Is Ping of Death still relevant today?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1he correct answer is B. Ping of death. ICMP (Internet Control Message Protocol) packets larger than 65,536 bytes are indicative of a "Ping of Death" attack. This type of attack involves sending malformed or malicious ICMP packets, specifically echo request (ping) packets, that exceed the maximum allowed size (65,536 bytes). This can cause the target system to crash, freeze, or become unstable. Here's a brief overview of the other options: A. Smurf attack: a type of DDoS attack that uses ICMP echo requests (pings) to flood a network, but the packets are typically not larger than 65,536 bytes. C. Fraggle attack: a type of DDoS attack that uses UDP packets, not ICMP packets, to flood a network. D. Nmap scan: a network scanning tool used for discovery and exploration, which typically doesn't involve sending large ICMP packets
-
Elb 👍 1 Answered BThe ping of death (PoD) attack is a DDoS attack that sends out abnormally large packets in order to disrupt a web server.
-
Elb 👍 1B > https://www.cloudflare.com/learning/ddos/ping-of-death-ddos-attack/
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.