hardMultiple ChoiceObjective-mapped
ICMP Abnormal Packet Size Analysis — False Positive vs Ping of Death
An intrusion analyst is analyzing a series of alerts from a network-based IDS. The alerts are triggered by the signature 'OVERFLOW-ICMP-ECHO' with a payload size of 65535 bytes. The source IP is a trusted internal server. What is the most likely explanation?
Quick Answer
The answer is that the IDS signature is incorrectly configured, because an ICMP Echo payload of exactly 65535 bytes is technically impossible under normal network operation. The total ICMP packet size is limited to 65535 bytes, but this includes the mandatory IP header (20 bytes) and ICMP header (8 bytes), so the actual data payload can never exceed 65507 bytes. A payload of exactly 65535 bytes would require the entire packet to exceed the maximum IP datagram size, making it a clear false positive rather than a genuine Ping of Death attack. On the Cisco CyberOps Associate 200-201 exam, this question tests your ability to distinguish between signature misconfiguration and actual overflow attacks, a common trap where analysts assume any large ICMP packet is malicious. The trusted internal server source IP further supports misconfiguration over an attack. Memory tip: remember the 65535 limit applies to the whole packet, not just the payload—subtract 28 for headers to find the real maximum.
⚠ Common exam trap
Watch out — candidates often assume a large ICMP payload must indicate an attack (like a Ping of Death or DDoS), but Cisco tests the understanding that a payload of exactly 65535 bytes is impossible in a single unfragmented ICMP packet, pointing to a signature misconfiguration rather than a real threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IDS signature is incorrectly configured
The ICMP Echo (ping) payload size is limited to 65535 bytes, but the actual data portion of an ICMP packet cannot exceed 65535 minus the IP and ICMP header sizes (typically 20 + 8 = 28 bytes), making a payload of exactly 65535 bytes impossible under normal operation. Since the source IP is a trusted internal server, the most plausible cause is that the IDS signature is misconfigured—likely with an incorrect payload size threshold or a false positive trigger—rather than an actual overflow attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server is performing a ping sweep
Why it's wrong here
Ping sweep uses normal ICMP payload sizes.
- ✗
There is a network error causing packet fragmentation
Why it's wrong here
Fragmentation would not create a payload larger than the limit.
- ✓
The IDS signature is incorrectly configured
Why this is correct
The payload size exceeds the maximum possible, so it's a false positive.
- ✗
The server is under a DDoS attack
Why it's wrong here
DDoS would not cause an impossible payload size.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a PCAP analysis, an analyst sees an ICMP echo reply packet that is larger than usual (2000 bytes). What is this likely indicating?
medium- A.ICMP flood
- B.Fragmented packet
- C.Smurf attack
- ✓ D.Ping of death attempt
Why D: A standard ICMP echo reply packet has a payload of 56 bytes (or 64 bytes including the ICMP header) for a total IP packet size of 84 bytes. A 2000-byte ICMP echo reply exceeds the maximum allowed size for an ICMP packet (65535 bytes for IPv4, but typical implementations limit the data portion to much smaller values). This oversized packet is characteristic of a Ping of Death attack, where the attacker sends a malformed ICMP packet that, when reassembled, causes a buffer overflow on the target system, leading to a crash or denial of service.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.