In this simulation, you will analyze network addressing fundamentals critical for network defense. Understanding reserved IP ranges is essential for identifying spoofing attempts and misconfigured internal routing.

CND (312-38) Network Defense Simulation

Network Scenario

You are monitoring a perimeter firewall for a corporate LAN. The network uses standard Class A/B/C private addressing (RFC 1918) internally. During a routine audit of the egress logs, you are checking for any traffic directed towards restricted or reserved address spaces that should not be routable over the public internet or standard internal segments.

Traffic & Logs

[2023-10-24 14:02:11] FIREWALL_DENY: SRC=192.168.1.45 DST=245.0.0.10 PROTO=TCP SPT=44332 DPT=80
[2023-10-24 14:02:15] IDS_ALERT: Outbound connection attempt to Reserved Space (Experimental) detected.
[2023-10-24 14:03:02] FIREWALL_DENY: SRC=192.168.1.12 DST=250.10.10.10 PROTO=UDP SPT=51231 DPT=53
[2023-10-24 14:05:44] SYSLOG: Interface eth0 dropped packet from 10.0.0.5 target range 240.0.0.0/4.

Question

The IP addresses reserved for experimental purposes belong to which of the following classes?

A. Class E
B. Class C
C. Class A
D. Class D

Think about the IP range from 240.0.0.0 to 255.255.255.255. This range is defined by the IANA but is not meant for general commercial use.

Expert Analysis

What is happening: The logs show internal hosts (192.168.1.x) attempting to communicate with IP addresses in the 240.0.0.0 to 255.255.255.255 range. These are invalid destinations for standard production traffic.

Behavior Identification: This behavior often indicates a misconfigured application, a scanning tool testing edge cases of the TCP/IP stack, or potentially malware attempting to use non-standard channels.

Correct Answer Reasoning: Class E (240.0.0.0 – 255.255.255.255) is explicitly reserved for experimental, research, and future use. These addresses are not used for standard host-to-host communication in any production environment.

Why others are wrong:

  • Class A: Used for large networks (1.0.0.0 – 126.255.255.255).
  • Class C: Used for small networks (192.0.0.0 – 223.255.255.255).
  • Class D: Reserved for Multicast traffic (224.0.0.0 – 239.255.255.255).

Defensive Action: Network Defenders should ensure that firewalls are configured to drop packets destined for Class E addresses (except perhaps the broadcast address 255.255.255.255). Any internal source attempting to reach these IPs should be investigated for suspicious activity or software bugs.

Mini Lesson: IP Class Recognition

  • Class A: 1-126 (Leading bit 0)
  • Class B: 128-191 (Leading bits 10)
  • Class C: 192-223 (Leading bits 110)
  • Class D (Multicast): 224-239 (Leading bits 1110)
  • Class E (Experimental): 240-255 (Leading bits 1111)

Explore more CND simulations

Practice More Tests