Which Service Did the Attacker Use Based on tcpdump Port Scan Results?

A network technician has identified a breach and is attempting to determine how the attacker connected to a device on the network. The technician uses tcpdump to perform a port scan and receives the following result: Which of the following describes how the attacker connected to the device? -

The attacker used Telnet.
The attacker used VNC.
The attacker used SSH. Source Reference Answer
The attacker used RDP.

Community Votes

83%

17%

83% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your ability to map tcpdump outputs to network services, with the trap being to confuse open ports like 22 (SSH) with failed connections like 23 (Telnet).

Learn how to interpret tcpdump port scan results to identify the service used in a network breach. CompTIA N10-008 candidates agree that an SYN-ACK response on port 22 indicates SSH was the connecting protocol.

The most common wrong answer is A (Telnet), likely because Telnet is a common breach target and port 23 appears in the scan, but the SYN-ACK on port 22 shows SSH was the actual open service.

Community Discussion (5 comments)

Cavick 👍 9 Selected: C

Syn-ack signifies and SSH connection was successful on port 22.

laosythai 👍 2 Selected: A

Did they mean to do “sun-ack” on port 23 and not 22 which would make more sense since 22 is secure shell and port 23 is Telnet and NOT secure meaning a breach is more likely…?

Zach123654 👍 1 Selected: C

GPTTTT

b0bby 👍 1

I don't know what to look for here. port 23 failed, port 22 syn-ack and port 3389 just syn. Don't know how to come to the conclusion any of these was the breach... I'm just assumming its RDP cause it tried twice??

emilia_088 👍 2

A I go with Telnet

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The tcpdump output reveals a successful TCP three-way handshake on port 22, indicated by the SYN-ACK response. Port 22 is the default port for SSH, a secure remote administration protocol. Therefore, the attacker established an SSH connection to the device. This aligns with community comment [1], which states "Syn-ack signifies and SSH connection was successful on port 22."

Why the Other Options Are Wrong

Telnet (option A) uses port 23, which the scan shows as failed or without SYN-ACK, meaning no connection was established. VNC (option B) typically uses port 5900, which is not indicated in the output. RDP (option D) uses port 3389, which appears to have sent only SYN packets without a successful handshake, as noted in comment [3]. Thus, only SSH corresponds to an open port with a completed handshake.

Community Comment Notes

The community is largely aligned on answer C, with 83 votes supporting SSH. Comment [2] raises a point about port 23 failing and port 22 succeeding, reinforcing that SSH was the active service. Comment [3] initially confused RDP due to multiple attempts, but the SYN-ACK on port 22 is the definitive indicator. The key takeaway from the comments is to focus on which port returned SYN-ACK rather than the number of attempts.

Official Reference

Exam Strategy

When analyzing tcpdump output for a port scan, always identify the port number that returns an SYN-ACK packet—it indicates an open port with a completed handshake. Conversely, a SYN packet without a response or an RST means the port is closed or filtered. Memorize common port-to-service mappings, such as 22 for SSH, 23 for Telnet, and 3389 for RDP, to quickly answer such questions.

Related Analysis

← Back to N10-008 Study Guide