Mark is monitoring the network traffic on his organization’s network. He wants to detect TCP and UDP ping sweeps on his network. Which type of filter will be used to detect this?

TCP and UDP ping sweeps using echo service operate on port 7. When detecting these sweeps, we monitor incoming connections to port 7, which means examining the destination port (dstport) for both protocols. The echo service responds on port 7, so legitimate ping sweep packets will target destination port 7 on both TCP and UDP. The source port is typically random/ephemeral and not relevant for detection.

A. Incorrect because it mixes destination and source ports inconsistently.
C. This is identical to option B (appears to be a duplicate).
D. Incorrect because UDP ping sweeps target destination port 7, not source port 7.

1. Stevens, W. R. (1994). TCP/IP Illustrated, Volume 1: The Protocols. Section 1.12 "Standard Simple Services," pp. 17-18. Addison-Wesley.

2. RFC 862 (1983). Echo Protocol. Network Working Group, J. Postel. Pages 1-2. https://datatracker.ietf.org/doc/html/rfc862

3. Parziale, L., et al. (2006). TCP/IP Tutorial and Technical Overview. IBM Redbooks, Section 3.2.1 "Well-known ports," pp. 89-90.

4. SANS Institute (2003). Intrusion Detection In-Depth. GIAC Practical Repository, Section "Reconnaissance Techniques," pp. 12-14.

5. Comer, D. (2014). Internetworking with TCP/IP Volume 1. Chapter 11 "User Datagram Protocol," pp. 197-199. Pearson.