GPEN · Question #463
You suspect that a firewall or IPS exists between you and the target machine. Which nmap option will elicit responses from some firewalls and IPSs while being silently dropped by the target, thus…
The correct answer is B. -Firewalk. The nmap Firewalk option probes intermediate filtering devices by crafting packets that trigger responses from firewalls or IPS devices while never reaching the actual target host.
Question
You suspect that a firewall or IPS exists between you and the target machine. Which nmap option will elicit responses from some firewalls and IPSs while being silently dropped by the target, thus confirming the existence of a firewall or IPS?
Options
- A-Traceroute
- B-Firewalk
- C-Badsum
- D--SF
How the community answered
(24 responses)- A4% (1)
- B83% (20)
- C8% (2)
- D4% (1)
Why each option
The nmap Firewalk option probes intermediate filtering devices by crafting packets that trigger responses from firewalls or IPS devices while never reaching the actual target host.
-Traceroute maps the network path to a target by recording TTL-expired ICMP replies from each hop but is not designed to distinguish firewall or IPS responses from normal router behavior.
The -Firewalk option applies the Firewalk technique, sending packets with a TTL value set to expire just beyond the suspected filtering device so that the firewall or IPS processes the packet and may generate a response, while the destination host never receives it. Because the target silently drops the packet due to TTL exhaustion and the firewall replies, the asymmetry in responses confirms the presence of an intermediate security device.
-Badsum sends packets with intentionally invalid TCP or UDP checksums to identify stateful inspection devices based on checksum-handling behavior, which is a distinct detection method not focused on probing firewall rule sets.
--SF is not a recognized nmap option and has no defined behavior for firewall or IPS detection.
Concept tested: nmap Firewalk technique for firewall and IPS detection
Source: https://nmap.org/nsedoc/scripts/firewalk.html
Topics
Community Discussion
No community discussion yet for this question.