Mason, a network forensic expert, is investigating a recent security incident on an organization server.

Option B is correct because the filter tcp.flags==0x003 identifies TCP packets with the SYN and FIN flags set together , which is abnormal in legitimate TCP communication and is commonly associated with suspicious or crafted traffic patterns. CHFI v11 specifically includes network protocols and packet analysis , gathering evidence via sniffers , and analyzing traffic for TCP SYN and SYN-FIN Flood DoS attacks within its network forensics objectives.

In a normal TCP session, SYN is used to initiate a connection, while FIN is used to gracefully terminate one. Seeing both together is inconsistent with ordinary session behavior and is therefore useful in detecting malformed or malicious packets generated during certain denial-of-service or evasion attempts. This is exactly the kind of anomalous packet pattern a forensic examiner would isolate in Wireshark when investigating suspected flooding or crafted traffic.

The other options do not match the filter. RST would require the reset flag, and SYN-only traffic would not have the FIN bit set. Therefore, based on CHFI network traffic investigation principles, Mason would expect the filter to help detect a SYN/FIN flooding attempt .