Identifying Ping of Death via Oversized ICMP Packets
An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests knowledge of legacy DoS techniques; the common trap is confusing large ICMP floods (Smurf/Fraggle) with malformed oversized packets designed to crash systems.
This question tests the ability to identify network attacks by analyzing packet characteristics in firewall logs. The presence of ICMP packets exceeding the maximum IP payload size is a definitive indicator of a Ping of Death attack.
Candidates often select Smurf or Fraggle, which involve amplification and broadcast forwarding rather than sending individual massive packets that exceed protocol limits.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B because the Ping of Death (PoD) is a specific denial-of-service attack that exploits the TCP/IP specification by sending ping packets larger than the maximum allowed size of 65,535 bytes (often cited as >65,536). When the target system receives these malformed packets, it fails to reassemble them correctly, leading to a system crash or freeze.Why the Other Options Are Wrong
Smurf (A) and Fraggle (C) are amplification attacks that use ICMP or UDP broadcasts to flood a target, but they rely on volume and spoofing, not necessarily oversized single packets. An Nmap scan (D) typically uses small, standard-sized probes for discovery and does not inherently involve sending massive ICMP fragments.Community Comment Notes
The community consensus strongly supports option B, with users noting that ICMP packets larger than 65,536 bytes are indicative of this specific legacy attack. As one user paraphrased, this involves "malformed or malicious ICMP packets" that cause instability, confirming the definition of PoD.Official Reference
Exam Strategy
Focus on the technical constraints of protocols; knowing that IPv4 headers have a 16-bit length field (max ~65k) helps you instantly rule out normal traffic when seeing values above that threshold.
Frequently Asked Questions
Why isn't this a Smurf attack?
Smurf attacks use ICMP Echo Requests sent to broadcast addresses to amplify traffic, whereas Ping of Death relies on sending single, malformed packets that exceed the maximum IP payload size.
Is Ping of Death still relevant today?
While modern operating systems are patched against this vulnerability, it remains a key concept in certification exams to test understanding of protocol limits and legacy DoS vectors.