Question

During intrusion analysis of a suspicious DNS-based exfiltration attempt, an analyst opens a captured UDP datagram in Wireshark. The Length field in the UDP header reads 512 bytes, but the actual amount of application data (the DNS payload) captured is only 480 bytes. Which interpretation of the UDP Length field is correct for this analysis?

Accepted Answer

The UDP Length field counts the 8-byte UDP header plus the payload, so 512 bytes indicates 504 bytes of DNS payload, revealing a mismatch worth investigating for truncation or crafted packets

Answer

The UDP Length field counts only the application payload, so it should equal 480 and the 512 value indicates a corrupted checksum

Answer

The UDP Length field includes the IP header, so 512 minus 20 bytes yields the true payload size

Answer

The UDP Length field is always fixed at 512 for DNS traffic and cannot be used to detect anomalies