Which technique allows an attacker to determine which ports are open behind a firewall by analyzing packet responses?

Which technique allows an attacker to determine which ports are open behind a firewall by analyzing packet responses?

• A. Firewalking
• B. Port knocking
• C. Banner grabbing
• D. Reconnaissance

Answer: (A)

Firewalking works by testing how a firewall treats probes to ports behind it and using the responses to map which traffic is allowed. The probes are crafted with TTLs that cause the packet to traverse toward an internal host behind the firewall and then either be forwarded or dropped by the firewall. If a probe reaches a host behind the firewall and the host or the firewall returns a response, you can infer that traffic on that port is allowed through. If no response or only an ICMP error is observed, that port is blocked or filtered. By sweeping across multiple ports or protocols and observing the resulting responses, you reveal which ports are open behind the firewall. This targeted use of TTL-limited probes and analysis of the resulting responses is what distinguishes firewalking.

Firewalking works by testing how a firewall treats probes to ports behind it and using the responses to map which traffic is allowed. The probes are crafted with TTLs that cause the packet to traverse toward an internal host behind the firewall and then either be forwarded or dropped by the firewall. If a probe reaches a host behind the firewall and the host or the firewall returns a response, you can infer that traffic on that port is allowed through. If no response or only an ICMP error is observed, that port is blocked or filtered. By sweeping across multiple ports or protocols and observing the resulting responses, you reveal which ports are open behind the firewall. This targeted use of TTL-limited probes and analysis of the resulting responses is what distinguishes firewalking.