There is a question bugging me a after reading on network security.
Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a protected private network.
(The port on a machine outside this protected network is not specified in the firewall's rules.)
Now imagine a botmaster, who tries to carry out an attack and communicate with a bot listening on port 80. The botmaster wants to for example send an IRC message "I got trough!" to any IRC channel, e.g. "starwars".
In order to get the packets trough (i.e. not get dropped by) the firewall, what kind of ipv4-packet should the bot master send in this particular scenario?
I'm especially interested in the TCP fields port numbers and the payload.
I'm totally confused on the 22 vs 80 part, how would that be possible. Why would this attack work?
And how could I adjust the firewall to be improved and detect any malicious behavior?