nerdexam
EC-Council

312-50V10 · Question #156

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drown based on these scan results? TCP port 21 - no response

The correct answer is C. The scan on port 23 passed through the filtering device. This indicates that port 23 was not. Firewalk maps firewall ACL rules by sending packets with TTL values set to expire one hop past the firewall. A 'Time-to-live exceeded' response means the packet passed through the firewall, while no response means the firewall blocked it.

Evading IDS, Firewalls, and Honeypots

Question

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drown based on these scan results? TCP port 21 - no response TCP port 22 - no response TCP port 23 - Time-to-live exceeded

Options

  • AThe scan on port 23 was able to make a connection to the destination host prompting the firewall
  • BThe lack of response from ports 21 and 22 indicate that those services are not running on the
  • CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not
  • DThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

How the community answered

(39 responses)
  • A
    10% (4)
  • B
    5% (2)
  • C
    82% (32)
  • D
    3% (1)

Why each option

Firewalk maps firewall ACL rules by sending packets with TTL values set to expire one hop past the firewall. A 'Time-to-live exceeded' response means the packet passed through the firewall, while no response means the firewall blocked it.

AThe scan on port 23 was able to make a connection to the destination host prompting the firewall

A 'Time-to-live exceeded' ICMP message indicates the packet passed the firewall and expired at the next hop, not that a full TCP connection was established with the destination host.

BThe lack of response from ports 21 and 22 indicate that those services are not running on the

No response in Firewalk scanning indicates the firewall is blocking the port - the packet never reached the target host, so the absence of a service on that host cannot be concluded.

CThe scan on port 23 passed through the filtering device. This indicates that port 23 was notCorrect

In Firewalk scanning, packets are crafted with a TTL set to expire exactly one hop beyond the firewall gateway. When port 23 returns a 'Time-to-live exceeded' ICMP message, it confirms the packet passed through the firewall, meaning port 23 is not filtered. Ports 21 and 22 returned no response, indicating the firewall silently dropped those packets before they could transit to the next hop.

DThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

The TTL-exceeded response for port 23 demonstrates the firewall is NOT blocking that port, and Firewalk cannot determine whether a specific service is actively listening on the target host.

Concept tested: Firewalk tool firewall ACL enumeration via TTL

Topics

#firewalking#TTL exceeded#firewall rule analysis#port filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice