Logan, a network security analyst, notices a pattern of repeated ICMP echo requests being sent...

The described activity—ICMP echo requests sent sequentially across many IP addresses—is a classic ping sweep, a reconnaissance technique used to identify live hosts on a network. ECIH network incident handling identifies reconnaissance as an early-stage attack activity that often precedes exploitation.

Option B is correct because ping sweeps use ICMP echo requests to determine which hosts respond, allowing attackers to map the network. This aligns exactly with the observed traffic.

Option A involves DNS manipulation. Option C involves probing TCP/UDP ports rather than ICMP. Option D describes a denial-of-service technique, not reconnaissance.

Recognizing reconnaissance activity early allows defenders to implement controls before exploitation occurs, aligning with ECIH detection and prevention guidance.