nerdexam
EC-Council

312-50V11 · Question #550

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results? TCP port 21 - no response

The correct answer is C. The scan on port 23 passed through the filtering device. This indicates that port 23 was not. Firewalk crafts packets with a TTL that expires one hop past the firewall - a TTL exceeded response confirms traffic was allowed through the filter, while no response indicates a blocking rule.

Evading IDS, Firewalls, and Honeypots

Question

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results? TCP port 21 - no response TCP port 22 - no response TCP port 23 - Time-to-live exceeded

Options

  • AThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target
  • BThe lack of response from ports 21 and 22 indicate that those services are not running on the
  • CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not
  • DThe scan on port 23 was able to make a connection to the destination host prompting the firewall

How the community answered

(40 responses)
  • A
    20% (8)
  • B
    5% (2)
  • C
    68% (27)
  • D
    8% (3)

Why each option

Firewalk crafts packets with a TTL that expires one hop past the firewall - a TTL exceeded response confirms traffic was allowed through the filter, while no response indicates a blocking rule.

AThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

While no response does indicate the firewall is blocking ports 21 and 22, a TTL exceeded message on port 23 does not confirm a service is listening on the target host - it only confirms the packet cleared the firewall.

BThe lack of response from ports 21 and 22 indicate that those services are not running on the

In Firewalk, no response means the firewall dropped the probe packet before it reached the destination host, indicating a blocking rule - not the absence of a running service on the target.

CThe scan on port 23 passed through the filtering device. This indicates that port 23 was notCorrect

In Firewalk, packets are sent with a TTL set to expire exactly one hop beyond the firewall. A 'Time-to-live exceeded' ICMP response on port 23 means the packet successfully traversed the filtering device and expired at the next hop, confirming port 23 is not blocked. This is the definitive Firewalk indicator that the firewall permits traffic on that port.

DThe scan on port 23 was able to make a connection to the destination host prompting the firewall

A TTL exceeded message does not indicate a successful connection to the destination; it means the packet's TTL expired in transit after passing the firewall, and no end-to-end connection was established.

Concept tested: Firewalk TTL-based firewall ACL enumeration

Topics

#Firewalk#TTL exceeded#firewall traversal#port filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice