John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?
A. Firewalk cannot pass through Cisco firewalls
B. Firewalk cannot be detected by network sniffers
C. Firewalk sets all packets with a TTL of one
D. Firewalk sets all packets with a TTL of zero
Answer:C
John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?
A. Firewalk cannot pass through Cisco firewalls B. Firewalk cannot be detected by network sniffers C. Firewalk sets all packets with a TTL of one D. Firewalk sets all packets with a TTL of zero
Explanation: Answer C is the best answer, but might not be completely true. It would be true if the machine running firewalk was on the direct subnet connected to the firewall. Otherwise the father away firewalk is from the firewall, the higher the TTL. Remember, that once the firewall has been reached, then the TTL will be +1, and is never raised above that. The TTL needs to be just enough to pierce the firewall to determine if the port is actually open. A sniffer immediately after the firewall, with no additional hops, will pick up the firewalk traffic, but any hops between the firewall and the sniffer will not reach the sniffer because the maximum TTL will only get the packet to the other side of the firewall, and no further.