Exam 312-49v10 topic 1 question 156 discussion

ANSWER IS D Key Concept: TTL Manipulation TTL (Time to Live) is a field in the IP header that determines how many hops a packet can take before being discarded. Each hop decreases the TTL by 1. What Firewalk Does: Firewalk sets the TTL to 1 (or another small value), so the packet expires at the first gateway (e.g., the Cisco PIX firewall in this case). Why Traffic Doesn't Appear in the Sniffer Logs: The sniffer is placed on a deeper subnet within the network. Firewalk's packets with TTL set to 1 expire at the first firewall (gateway) and never make it past this point. Since the packets don't reach the deeper subnet where the sniffer is located, they aren't logged or detected by the sniffer.

D < ... It works by sending out TCP or UDP packets with a TTL one [hop greater than the targeted gateway].

The Firewalk tool typically sends packets with varying TTL values, starting with a TTL of 1 and incrementing it with each probe. By monitoring the responses to these packets, Firewalk can infer the behavior of the target firewall. If a packet with a specific TTL value is allowed to pass through the firewall and reach its intended destination, Firewalk deduces that the corresponding port is open. If the packet is blocked or dropped by the firewall, Firewalk determines that the port is closed. --> Firewalk sets all packets with a TTL of one

I think the best answer is A. Firewalk is used to test the security of the firewall. If tested ports are closed or ICMP is droped by the firewall (which is a good security option) nothing will go trough the FW whatever the TTL. Another possibility is that the sniffer is placed too far from the target and the TTL is too low. So nothing reach the sniffer. But I prefere the A response. Any other suggestion is welcomed

This is not correct. Firewalk does not set TTL of all packets to one... it sets the TTL to one hop greater than the target gateway. The best answer is probably C, if this is the way the answers are actually worded on the exam question.