CHFI ICMP Flood Practice Question
In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?
⚠ Common exam trap
EC-Council often tests the ability to differentiate between reconnaissance and attack by presenting ICMP traffic with varying payloads. Candidates may mistakenly classify a high-volume single-target ICMP flood as a ping sweep (Option A) due to the payload variation, but the key indicator is the single destination and overwhelming volume, which points to a DoS attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A DoS attack using ICMP floods
The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption. In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network reconnaissance (ping sweep)
Why it's wrong here
A ping sweep is a reconnaissance technique in which an attacker sends ICMP echo requests to multiple different destination IP addresses (or a broadcast address) to discover which hosts are alive on a network. In this capture, the traffic consists of ICMP echo requests from one source to one destination, which is a point-to-point conversation rather than a probe across many targets. The absence of varied destination addresses or sequential host probing means this is not characteristic of network reconnaissance.
- ✗
A man-in-the-middle attack
Why it's wrong here
A man-in-the-middle (MITM) attack requires an attacker to actively intercept, relay, and potentially alter communications between two legitimate parties, often using techniques such as ARP spoofing, DNS spoofing, or session hijacking. ICMP echo requests are simple network-layer probes that do not carry application data or involve a relayed session between two hosts. Seeing a flood of ICMP echo requests provides no evidence of interception, modification, or an inserted third party, so this scenario cannot be classified as MITM.
- ✓
A DoS attack using ICMP floods
Why this is correct
A large volume of ICMP echo requests (ping) from a single source to a single destination, especially with varying payload sizes, is a classic signature of an ICMP flood DoS attack. The sheer volume of packets consumes the target's bandwidth and processing resources, and the varied payload sizes are often used to defeat filters that block only fixed-size pings. This pattern is distinct from reconnaissance or protocol-specific abuse because it intentionally overwhelms the victim with raw ICMP traffic.
- ✗
A DNS amplification attack
Why it's wrong here
A DNS amplification attack relies on an attacker sending small, spoofed DNS queries to open resolvers, which then send large DNS response messages to the victim's IP address, creating a reflected and amplified flood. The traffic in this scenario is explicitly ICMP echo requests, not UDP/TCP DNS queries or responses on port 53, and the pattern is a single source sending to a single destination rather than many resolvers responding to a spoofed victim. Therefore, the observed ICMP flood does not match the mechanics or signature of DNS amplification.
Visual reference
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.