nerdexam
EC-Council

312-50V9 · Question #424

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results? TCP port 21 - no…

The correct answer is C. The scan on port 23 passed through the filtering device. This indicates that port 23 was not. Firewalk determines firewall rules by sending TTL-limited packets; a TTL-exceeded reply means the packet passed through the firewall, while no reply means it was dropped.

Evading IDS, Firewalls, and Honeypots

Question

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results? TCP port 21 - no response TCP port 22 - no response TCP port 23 - Time-to-live exceeded

Options

  • AThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target
  • BThe lack of response from ports 21 and 22 indicate that those services are not running on the
  • CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not
  • DThe scan on port 23 was able to make a connection to the destination host prompting the firewall

How the community answered

(41 responses)
  • A
    27% (11)
  • B
    5% (2)
  • C
    59% (24)
  • D
    10% (4)

Why each option

Firewalk determines firewall rules by sending TTL-limited packets; a TTL-exceeded reply means the packet passed through the firewall, while no reply means it was dropped.

AThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target

Port 23 returning a TTL-exceeded message proves the firewall allowed that traffic through, directly contradicting the claim that all three ports are blocked by the firewall.

BThe lack of response from ports 21 and 22 indicate that those services are not running on the

No response in a Firewalk scan indicates the firewall is blocking the port at the perimeter, not that a service is absent on the target host behind the firewall.

CThe scan on port 23 passed through the filtering device. This indicates that port 23 was notCorrect

In Firewalk's scanning phase, packets are crafted with a TTL set to expire exactly one hop past the firewall. A 'Time-to-live exceeded' response on port 23 means the firewall forwarded that packet and the next-hop router returned the ICMP expiry message, proving port 23 is not filtered. Ports 21 and 22 received no response because the firewall silently dropped those packets before they reached the next hop.

DThe scan on port 23 was able to make a connection to the destination host prompting the firewall

Firewalk does not establish a TCP connection to the destination host; the TTL-exceeded message originates from the router one hop past the firewall, not from the target itself.

Concept tested: Firewalk TTL-based firewall rule enumeration

Topics

#Firewalk#TTL exceeded#firewall port filtering#packet gateway analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice