Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network. Which of the following host…

Question

Options

• AUDP scan
• BTCP Maimon scan
• Carp ping scan
• DACK flag probe scan

• A
  15% (7)
• B
  4% (2)
• C
  72% (34)
• D
  9% (4)

Explanation

ARP Ping Scan for IPv4 Host Discovery

Why C is correct: ARP (Address Resolution Protocol) ping scan is the most effective technique for discovering active devices on a local IPv4 network, even when those devices are hidden behind a restrictive firewall. Because ARP operates at Layer 2 (Data Link layer), it bypasses firewall rules that typically filter IP-based traffic - firewalls cannot block ARP requests on the local network segment, making it impossible for devices to hide from this type of scan.

Why the distractors are wrong:

• A (UDP scan): UDP scans operate at Layer 3/4 and can be blocked or filtered by firewalls, making them unreliable for discovering hidden hosts.
• B (TCP Maimon scan): This is a firewall evasion technique using FIN/ACK flags, but it's designed to map firewall rules, not reliably discover hidden hosts.
• D (ACK flag probe scan): This technique is primarily used to identify firewall rules and stateful filtering, not to discover active hosts hidden by firewalls.

Memory Tip: Think "ARP = Always Reveals Presence" - since ARP is essential for network communication at the hardware level, devices on a local network must respond to ARP requests, making it the go-to technique for local IPv4 host discovery regardless of firewall restrictions.

No community discussion yet for this question.