Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how could you figure out which ports were closed on the webserver and which ports were blocked by the firewall. You can use whatever tools that you want".

A hint that was given to me was the principle used in traceroute - i.e. the idea of sending packets with a varying TTL value so that TTL-exceeded messages would be sent back from the intermediate device.

What are the various methods in which such a goal could be achieved(with or without the hint).

share|improve this question
    
. removed my comment –  jippie Apr 17 '12 at 18:04

2 Answers 2

up vote 6 down vote accepted

There is a tool called Firewalk that is designed to accomplish this goal. It's a bit old but since networking hasn't changed much in that time I expect it should still work.

Article, tutorial, project home page.

The whitepaper linked from the article is now at http://packetfactory.openwall.net/projects/firewalk/firewalk-final.pdf.

The general concept is that as long as there is a hop after the firewall, you can set the TTL of a packet so that it gets one hop past the firewall and expires, causing an ICMP response to be sent back to you. If you get no response, the firewall blocked the packet. If you get a response, the firewall didn't block the packet (meaning the target host must be).

There are ways this could go wrong, such as outbound ICMP messages being denied by the firewall, a different firewall may be blocking inbound or outbound traffic, general packet loss, the target host being down or there being no hops after the firewall before the target server, but if you get a positive response out of it then you know it will be accurate. The Firewalk tool has techniques to try to detect false negatives.

You can probably achieve similar results with traceroute although you may need to fiddle with the options such as the type and size of packets that you send and you will need to send many different probes to rule out false negatives. The whitepaper uses traceroute extensively in examples.

share|improve this answer
    
Nice explanation, just a minor correction/addition: Windows systems implement traceroute (named tracert) with ICMP packets. The correct implementation (as defined by van Jackobson) would send UDP packets to receive ICMP answers. In any case, for such tests I would prefer to use a dedicated packet editor. –  Georgios Apr 17 '12 at 12:01
    
Besides WPE Pro, what would be your favorite packet editor and why? Also in windows you are correct the command is tracert, however in linux traceroute is the correct syntax. Being a Windows admin this used to drive me nuts having DOS roots when learning Linux. The way I see it, it's like American English, British, and Australian English. Sometimes it's frustrating that the dialect seems incorrect and you have to find another way to communicate. –  Brad Apr 17 '12 at 15:18

Layer 4 traceroute is what he was hinting at.

http://en.m.wikipedia.org/wiki/Layer_four_traceroute

Many ways to do this. More importantly if the firewall was "rejecting" packets the reply would generally initiate from the firewall and not the web server (close inspection of TCP syn/ack numbers can tell you which one is which "depending on the firewall", but this won't work behind a WAF).

Another low tech way to make the distinction (which will work even if there is a WAF) is round-trip latency, firewalls are FAST and will respond quickly with your resets, a webserver listening on the other side will have a different latency signature (appear slower) and its RST packets may (optionally) follow more info like HTTP 5XX headers from the web server. You can check this type thing with Wireshark and Nmap, netcat, or curl. Hope this helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.