Can a router detect transitive/cascaded telnet sessions?

Question

I'm in my LAN segment , my desktops IP is x.x.x.x ; and I'm telneting to router A with its IP y.y.y.y from x.x.x.x .Now telnet session is established between x.x.x.x and y.y.y.y I want to telnet to router B with its ip addr z.z.z.z, from router A with IP y.y.y.y.

The chain is DESKTOP >(Telnet)> Router A >(TELNET)> Router B.

My setup is like this:

• Desktop x.x.x.x is on LAN seg and in inside zone of firewall
• y.y.y.y is on remote side and I've route to it.
• z.z.z.z is my real goal

I'm using y.y.y.y as proxy to reach z.z.z.z but problem is that, while I directly telnet to z.z.z.z from x.x.x.x, logs gets generated in firewall a.a.a.a which is between x.x.x.x and z.z.z.z. That's why I'm using y.y.y.y as proxy and this session gets less attention.

My question is while I'm having cascaded connection to z.z.z.z from x.x.x.x and intermediate router is y.y.y.y, will the firewall look at this session and will come to know that this cascaded session and desktops end connecting node is z.z.z.z which is imp ip addr for org. Does telnet session has any fields or flags or src & dst addr fields which might tell firewall that this is cascaded session? I've checked from my desktop its showing telnet conn established between x.x.x.x and y.y.y.y while actually I'm accessing z.z.z.z via y.y.y.y.

Answer 1

No, the firewall logs will show 2 TCP sessions:

1. A session from x.x.x.x to y.y.y.y
2. A session from y.y.y.y to z.z.z.z

You are opening a remote shell session on y.y.y.y and using that to connect to z.z.z.z, there isn't anything on the firewall that is going to automatically tie these 2 connections together. A competent and curious firewall engineer would certainly be able to join the dots though, as there are logs for the incoming and outgoing sessions, and system logs on the firewall itself that will show the logins.

I hope you aren't doing anything you shouldn't be.