ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ80

VerifiedNetwork Penetration Testing Methodology – Internal

Rebecca is a Penetration Tester at a security services firm called Xsecurity. She placed a sniffer on a subnet located deep within a client's network.

She used the Firewalk tool to assess the security of the company's network firewall. Afterward, when Rebecca reviewed the sniffer logs, she could not see any traffic generated by Firewalk.

What is the reason for this?

Explanation

Firewalk uses TTL-limited probe packets to identify how a firewall handles traffic. Packets intended to expire at the relevant hop use a TTL of one, so they do not continue deep enough into the internal network to be captured by a sniffer on a distant internal subnet.

Community Discussion

No comments yet. Be the first to start the discussion!