Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn…

Firewalk determines firewall ACL rules by sending packets with a TTL value set to expire one hop past the gateway. If a packet passes through the firewall, the next-hop router will return an ICMP "Time-to-live exceeded" message. This is the expected result for an open or allowed port. If the firewall blocks the packet, it is silently dropped, and Firewalk receives "no response."

In this scenario, the "Time-to-live exceeded" message for TCP port 23 confirms the packet traversed the firewall, indicating the firewall's ruleset permits traffic on this port. The "no response" for ports 21 and 22 indicates they were blocked by the firewall.

A. "No response" indicates the firewall blocked the packet; we cannot determine the state of services on the destination server because the probe never reached it.

B. The ICMP "TTL exceeded" message is from a router past the firewall, not the firewall itself, and it does not signify a completed connection.

D. The results explicitly show the firewall is not blocking port 23. The scan only reveals the firewall rule, not the status of the service on the target.

1. Schiffman

M.

& Ofir

D. (1998). Firewalking: A Traceroute-like analysis of an IP packet's path through a firewall. This foundational paper describes the tool's methodology. In Section 3

"The Scan

" it states: "If we get a 'TTL expired in transit' error message back

we know that the packet passed through the firewall... If we get no response

the packet was probably dropped."

2. Zwicky

E. D.

Cooper

S.

& Chapman

D. B. (2000). Building Internet Firewalls

2nd Edition. O'Reilly & Associates. In Chapter 26

"Auditing and Logging

" the mechanism of Firewalk is detailed

explaining that a TTLEXPIRED message indicates a packet has passed the firewall.

3. Purdue University. (n.d.). CS 42600: Computer Security

Lecture 11: Network Security. In the slides covering network scanning tools

the principle of Firewalk is explained: "If TTL exceeded is received

port is open. If nothing is received

port is filtered." This aligns directly with the question's output.