Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in my LAN segment , my desktops IP is x.x.x.x ; and I'm telneting to router A with its IP y.y.y.y from x.x.x.x .Now telnet session is established between x.x.x.x and y.y.y.y I want to telnet to router B with its ip addr z.z.z.z, from router A with IP y.y.y.y.

The chain is DESKTOP >(Telnet)> Router A >(TELNET)> Router B.

My setup is like this:

  • Desktop x.x.x.x is on LAN seg and in inside zone of firewall
  • y.y.y.y is on remote side and I've route to it.
  • z.z.z.z is my real goal

I'm using y.y.y.y as proxy to reach z.z.z.z but problem is that, while I directly telnet to z.z.z.z from x.x.x.x, logs gets generated in firewall a.a.a.a which is between x.x.x.x and z.z.z.z. That's why I'm using y.y.y.y as proxy and this session gets less attention.

My question is while I'm having cascaded connection to z.z.z.z from x.x.x.x and intermediate router is y.y.y.y, will the firewall look at this session and will come to know that this cascaded session and desktops end connecting node is z.z.z.z which is imp ip addr for org. Does telnet session has any fields or flags or src & dst addr fields which might tell firewall that this is cascaded session? I've checked from my desktop its showing telnet conn established between x.x.x.x and y.y.y.y while actually I'm accessing z.z.z.z via y.y.y.y.

share|improve this question
This is almost unreadable. Please use appropriate formatting in future please. – Polynomial Dec 3 '12 at 9:52
Impossible to say, since you don't indicate where the firewall is. Is the firewall on one of the routers, or is it a separate device? – Mark C. Wallace Dec 3 '12 at 12:11
up vote 1 down vote accepted

No, the firewall logs will show 2 TCP sessions:

  1. A session from x.x.x.x to y.y.y.y
  2. A session from y.y.y.y to z.z.z.z

You are opening a remote shell session on y.y.y.y and using that to connect to z.z.z.z, there isn't anything on the firewall that is going to automatically tie these 2 connections together. A competent and curious firewall engineer would certainly be able to join the dots though, as there are logs for the incoming and outgoing sessions, and system logs on the firewall itself that will show the logins.

I hope you aren't doing anything you shouldn't be.

share|improve this answer
@GdD...It was nice to hear it from you.thanks – user16691 Dec 3 '12 at 10:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.