Which of the following Wireshark filters allows an administrator to detect SYN/FIN DDoS attempt on the network?

The question asks for a filter to detect a "SYN/FIN" attempt. This implies a TCP packet where both the SYN (Synchronize) and FIN (Finish) flags are set simultaneously. In TCP, flags are represented by bit values: SYN is 2 (0x002) and FIN is 1 (0x001). A packet with both flags set would have a combined flag value of 2 + 1 = 3. The Wireshark display filter for this specific combination is tcp.flags==0x003. Such packets are invalid according to the TCP state machine and are often used in reconnaissance scans.

B. tcp.flags==0x029 corresponds to a value of 41 (32+8+1), representing URG + PSH + FIN flags. This is a classic "Xmas Scan," not a SYN/FIN packet.
C. TCP.flags==0x300 is not a standard or meaningful TCP flag combination. Also, Wireshark filters are case-sensitive; the correct field is tcp.flags.
D. tcp.dstport==7 filters for traffic destined for the 'echo' protocol port (port 7). It does not inspect TCP flags and is unrelated to detecting malformed packets.

- Wireshark Foundation. (n.d.). Display Filter Reference: TCP. Wireshark Official Documentation. Retrieved from wireshark.org. The documentation specifies tcp.flags as the field for the TCP flags byte and shows how to filter on its hexadecimal value.

- Stevens, W. R. (1994). TCP/IP Illustrated, Volume 1: The Protocols. Addison-Wesley. Chapter 18, "TCP Connection Establishment and Termination," details the valid flag combinations for TCP states. A SYN/FIN combination is not part of any legitimate state transition.

- Sanders, C. (2011). Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems (2nd ed.). No Starch Press. Chapter 7, "Common Lower-Layer Attacks," describes how to identify scan traffic, including malformed packets with invalid flag combinations, using Wireshark filters.