nerdexam
EC-Council

312-50V11 · Question #156

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drown based on these scan results? TCP port 21 - no…

The correct answer is C. The scan on port 23 passed through the filtering device. This indicates that port 23 was not. In Firewalk results, a 'TTL exceeded' response on port 23 confirms the packet passed through the firewall, while no response on ports 21 and 22 means those packets were dropped by the firewall.

Evading IDS, Firewalls, and Honeypots

Question

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drown based on these scan results? TCP port 21 - no response TCP port 22 - no response TCP port 23 - Time-to-live exceeded

Options

  • AThe scan on port 23 was able to make a connection to the destination host prompting the firewall
  • BThe lack of response from ports 21 and 22 indicate that those services are not running on the
  • CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not
  • DThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

How the community answered

(45 responses)
  • A
    7% (3)
  • B
    11% (5)
  • C
    60% (27)
  • D
    22% (10)

Why each option

In Firewalk results, a 'TTL exceeded' response on port 23 confirms the packet passed through the firewall, while no response on ports 21 and 22 means those packets were dropped by the firewall.

AThe scan on port 23 was able to make a connection to the destination host prompting the firewall

A 'TTL exceeded' response does not indicate a successful connection to the destination host; it means the packet was forwarded past the firewall but its TTL expired at the next router before reaching the target.

BThe lack of response from ports 21 and 22 indicate that those services are not running on the

No response on ports 21 and 22 indicates the firewall is blocking those packets at the perimeter, not that the services are absent on the destination host, because the packets never reached the destination to trigger any service-level response.

CThe scan on port 23 passed through the filtering device. This indicates that port 23 was notCorrect

Firewalk sets the IP TTL so packets expire one hop beyond the firewall. When port 23 returns a 'TTL exceeded' ICMP message, it proves the firewall forwarded that packet, meaning port 23 is not blocked by the filtering rules. The complete absence of any response on ports 21 and 22 indicates the firewall silently dropped those packets before they could reach the next hop, confirming those ports are filtered.

DThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

Port 23 is not being blocked by the firewall - the 'TTL exceeded' response is evidence the firewall forwarded it; it is specifically ports 21 and 22 for which the firewall is dropping traffic.

Concept tested: Interpreting Firewalk TTL scan results

Topics

#firewalking#TTL exceeded#firewall rule analysis#port filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice