nerdexam
EC-Council

312-50V13 · Question #359

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results? TCP port 21 no response…

The correct answer is C. The scan on port 23 passed through the filtering device. This indicates that port 23 was not. The Firewalk scan results indicate that TCP port 23 passed through the filtering device because a 'Time-to-live exceeded' message was received, while ports 21 and 22 are likely blocked by the firewall due to 'no response'.

Submitted by dimitri_ru· Mar 6, 2026Scanning Networks

Question

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results? TCP port 21 no response TCP port 22 no response TCP port 23 Time­to­live exceeded

Options

  • AThe lack of response from ports 21 and 22 indicate that those services are not running on the
  • BThe scan on port 23 was able to make a connection to the destination host prompting the firewall
  • CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not
  • DThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

How the community answered

(64 responses)
  • A
    6% (4)
  • B
    14% (9)
  • C
    77% (49)
  • D
    3% (2)

Why each option

The Firewalk scan results indicate that TCP port 23 passed through the filtering device because a 'Time-to-live exceeded' message was received, while ports 21 and 22 are likely blocked by the firewall due to 'no response'.

AThe lack of response from ports 21 and 22 indicate that those services are not running on the

A 'no response' from ports 21 and 22 in Firewalk typically means the firewall is blocking the traffic, preventing the probes from reaching the target or eliciting a TTL exceeded response beyond the firewall. It does not definitively confirm whether the services are running on the target itself.

BThe scan on port 23 was able to make a connection to the destination host prompting the firewall

A 'Time-to-live exceeded' message indicates that the packet was *forwarded* by the firewall and then expired, not necessarily that it made a full connection to the destination host. It confirms the firewall passed the packet, but doesn't confirm the service listening state on the target.

CThe scan on port 23 passed through the filtering device. This indicates that port 23 was notCorrect

In Firewalk, a 'Time-to-live exceeded' message from a firewall indicates that the packet for TCP port 23 was allowed to pass through the filtering device. This means the firewall decremented the packet's TTL and forwarded it to the next hop, where its TTL expired, signifying that port 23 is not being filtered by that specific firewall hop.

DThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

The 'Time-to-live exceeded' for port 23 explicitly shows that the firewall *did not block* this port, as the packet successfully traversed it. If the firewall were blocking it, it would typically drop the packet or send an ICMP 'port unreachable'.

Concept tested: Firewalk firewall traversal detection

Source: https://www.sans.org/blog/firewalk-and-ttl-a-closer-look/

Topics

#Firewalk#firewall bypass#port scanning#TTL exceeded

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice