Which of the following Wireshark filters allows an administrator to detect SYN/FIN DDoS attempt on the network?

The correct Wireshark filter to detect a SYN/FIN DDoS attempt is tcp.flags==0X029. This filter is

designed to capture packets where both the SYN and FIN flags are set, which is an unusual

combination and indicative of a SYN/FIN attack. In a typical three-way TCP handshake, the SYN and

FIN flags are not set in the same TCP segment. A SYN flag is used to initiate a connection, and a FIN

flag is used to politely close a connection. Therefore, seeing both flags set in the same packet

suggests a possible SYN/FIN DDoS attack.

Reference: The answer is based on the standard behavior of TCP flags in network communications

and the detection of anomalous flag combinations that signify potential DDoS attacks. While specific

to the EC-Council’s Certified Network Defender (CND) course materials cannot be

provided here, the explanation aligns with the general knowledge of network security practices and

the use of Wireshark for network analysis.