If you see IPv6-like payloads inside UDP packets destined to port 3544, which protocol is likely in use?

Enhance your skills with the GCIA Traffic Analysis Test. Prepare with insightful questions and detailed explanations. Excel in your exam!

Multiple Choice

If you see IPv6-like payloads inside UDP packets destined to port 3544, which protocol is likely in use?

Explanation:
The scenario points to Teredo. Teredo is an IPv6 transition mechanism that tunnels IPv6 datagrams over UDP, specifically over IPv4 networks, to help traverse NATs. Each IPv6 packet is encapsulated inside a UDP/IPv4 header, so you end up seeing IPv6-like payloads inside UDP traffic destined to a well-known port used by Teredo. The default destination port for Teredo is 3544, which is why you’d observe UDP packets to that port carrying IPv6-style payloads. In contrast, the other options don’t match this pattern: L2TP uses UDP but for VPN connections and doesn’t carry IPv6-in-UDP in this way; PPTP uses TCP instead of UDP for control, and GRE is not UDP-based and doesn’t specifically imply IPv6-in-UDP payloads.

The scenario points to Teredo. Teredo is an IPv6 transition mechanism that tunnels IPv6 datagrams over UDP, specifically over IPv4 networks, to help traverse NATs. Each IPv6 packet is encapsulated inside a UDP/IPv4 header, so you end up seeing IPv6-like payloads inside UDP traffic destined to a well-known port used by Teredo. The default destination port for Teredo is 3544, which is why you’d observe UDP packets to that port carrying IPv6-style payloads.

In contrast, the other options don’t match this pattern: L2TP uses UDP but for VPN connections and doesn’t carry IPv6-in-UDP in this way; PPTP uses TCP instead of UDP for control, and GRE is not UDP-based and doesn’t specifically imply IPv6-in-UDP payloads.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy