路由器上的封包過濾(packet filtering)可以檢查封包上的來源端位址(source
address)來做是否轉傳封包的依據。請問這項功能對於防止攻擊者以偽造身分來發
送封包有何幫助?執行封包過濾的路由器應該位於網路上的那個位置才有效?這項
功能可以阻擋垃圾郵件以假名發送嗎?(12 分)
六、惡意軟體有多種,請分別說明病毒(virus)、蠕蟲(worm)、木馬(Trojan horse)
程式的特徵。電子郵件的附件檔名為”goodie.exe”可能是那一種惡意軟體?(12 分)
101年公務人員特種考試警察人員考試、
101年公務人員特種考試一般警察人員考試及
101年特種考試交通事業鐵路人員考試試題
類 科: 刑事警察人員電子監察組
全一張
(背面)
ustekC_d0:fc:54 Broadcast ARP 60 Who has 140.123.109.3?
ame 55: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
0:fc:54 (48:5b:39:d0:fc:54), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
estination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..1. .... .... .... .... = LG bit: Locally administered address
ekC_d0:fc:54 (48:5b:39:d0:fc:54)
Address: AsustekC_d0:fc:54 (48:5b:39:d0:fc:54)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
: ARP (0x0806)
ailer: 000000000000000000000000000000000000
ss Resolution Protocol (request)
ol type: IP (0x0800)
: 6
uitous: False]
ress: AsustekC_d0:fc:54 (48:5b:39:d0:fc:54)
: 140.123.109.2 (140.123.109.2)
get MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
get IP address: 140.123.109.3 (140.123.109.3)
No
55 8.082801 As
. Time Source Destination Protocol Length Info
Fr
Ethernet II, Src: AsustekC_d
D
Source: Asust
Type
Tr
Addre
Hardware type: Ethernet (1)
Protoc
Hardware size
Protocol size: 4
Opcode: request (1)
[Is grat
Sender MAC add
Sender IP address
Tar
Tar
七、圖一是用Wireshark(前身為Ethereal)擷取下來的封包資訊。
發送此封包的機器,其IP 位址為何?(2 分)
這個封包的接收者是誰?(3 分)
請詳述這個封包的用途。(3 分)
會對此封包做出回應的機器,其IP 位址為何?(3 分)
請寫出回應封包的內容。(3 分)
圖一