CAPEC-331: ICMP IP Total Length Field Probe
Description
An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.
- Likelihood of attack
- Medium
- Typical severity
- Low
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card.
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism; Hide Activities
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.