312-49 · Question #395
John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files…
The correct answer is A. Firewalk sets all packets with a TTL of one. Firewalk probes firewall ACL rules by sending packets with a TTL calculated to expire just one hop beyond the target gateway (firewall). The firewall processes the packet through its access control rules-if the port is open it forwards the packet, and the next router…
Question
John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?
Options
- AFirewalk sets all packets with a TTL of one
- BFirewalk sets all packets with a TTL of zero
- CFirewalk cannot pass through Cisco firewalls
- DFirewalk cannot be detected by network sniffers
How the community answered
(17 responses)- A88% (15)
- C6% (1)
- D6% (1)
Explanation
Firewalk probes firewall ACL rules by sending packets with a TTL calculated to expire just one hop beyond the target gateway (firewall). The firewall processes the packet through its access control rules-if the port is open it forwards the packet, and the next router immediately discards it (TTL exhausted) and returns an ICMP 'Time Exceeded' message back to the attacker. Because the packet's TTL is set to expire right at or just past the firewall, the probe never travels deep enough into the internal network to be captured by a sniffer on a subnet behind the firewall.
Topics
Community Discussion
No community discussion yet for this question.