You send SYN packets with the exact TTL of the target system starting at port 1 and going up to port 1024 using hping2 utility. This attack is known as __________.

Port scanning typically involves direct connection attempts or probes to a host to determine open ports, without the TTL manipulation designed to infer firewall rule sets.

Spoofing refers to forging source addresses or identities in packets to impersonate another host, which is unrelated to TTL-based firewall rule enumeration.

Cloaking is not a recognized network attack technique in this context; the TTL-based enumeration described is specifically defined as firewalking.

Firewalking sets the IP TTL to expire exactly one hop past the target firewall, then sweeps through ports; if a port is allowed, the TTL-expired ICMP message comes from the next-hop device, revealing the firewall's access control rules without directly connecting to the destination host.