Question

While analyzing a PCAP in Wireshark, an analyst notices a series of TCP packets sent to hundreds of different destination ports on a single host. Each packet shows a window size of 1024 but has no TCP flags set at all (the Flags field reads 0x000). What is the MOST likely activity represented by these packets?

Accepted Answer

A TCP NULL scan being used for reconnaissance and port discovery

Answer

A normal TCP three-way handshake establishing multiple sessions

Answer

A TCP SYN flood denial-of-service attack against the host

Answer

Retransmission of dropped ACK segments due to network congestion