10

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how could you figure out which ports were closed on the webserver and which ports were blocked by the firewall. You can use whatever tools that you want".

A hint that was given to me was the principle used in traceroute - i.e. the idea of sending packets with a varying TTL value so that TTL-exceeded messages would be sent back from the intermediate device.

What are the various methods in which such a goal could be achieved(with or without the hint).

Improve this question
1
  • . removed my comment
    – jippie
    Commented Apr 17, 2012 at 18:04

1 Answer 1

Reset to default
7

There is a tool called Firewalk that is designed to accomplish this goal. It's a bit old but since networking hasn't changed much in that time I expect it should still work.

Article, tutorial, project home page.

The whitepaper linked from the article is now at http://packetfactory.openwall.net/projects/firewalk/firewalk-final.pdf.

The general concept is that as long as there is a hop after the firewall, you can set the TTL of a packet so that it gets one hop past the firewall and expires, causing an ICMP response to be sent back to you. If you get no response, the firewall blocked the packet. If you get a response, the firewall didn't block the packet (meaning the target host must be).

There are ways this could go wrong, such as outbound ICMP messages being denied by the firewall, a different firewall may be blocking inbound or outbound traffic, general packet loss, the target host being down or there being no hops after the firewall before the target server, but if you get a positive response out of it then you know it will be accurate. The Firewalk tool has techniques to try to detect false negatives.

You can probably achieve similar results with traceroute although you may need to fiddle with the options such as the type and size of packets that you send and you will need to send many different probes to rule out false negatives. The whitepaper uses traceroute extensively in examples.

Improve this answer
2
  • Nice explanation, just a minor correction/addition: Windows systems implement traceroute (named tracert) with ICMP packets. The correct implementation (as defined by van Jackobson) would send UDP packets to receive ICMP answers. In any case, for such tests I would prefer to use a dedicated packet editor.
    – George
    Commented Apr 17, 2012 at 12:01
  • Besides WPE Pro, what would be your favorite packet editor and why? Also in windows you are correct the command is tracert, however in linux traceroute is the correct syntax. Being a Windows admin this used to drive me nuts having DOS roots when learning Linux. The way I see it, it's like American English, British, and Australian English. Sometimes it's frustrating that the dialect seems incorrect and you have to find another way to communicate.
    – Brad
    Commented Apr 17, 2012 at 15:18

You must log in to answer this question.