Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram:

Network Diagram

(Skip to the bottom of the following explanation for a direct list of my questions)

Configuration Details:

  • Firewall is an ASA 5505 with static routes.
  • The firewall will respond to ICMP echo requests at
  • The firewall has TCP port 31337 left intentionally open so that we can detect it as part of the exercise.
  • The "Host" at is acting as the "attacker" trying to determine the open ports.
  • The "Attacker" is running Kali linux.
  • The "Target" host is running Windows Web Server 2008 (not sure that matters).

Attempted Methods:

I have tried both the "Firewalk" tool by Packetfactory and also the Nmap firewalk script. Here are examples of the syntax I am using:

Nmap: nmap --traceroute --script=firewalk --script-args=firewalk.max-probed-ports=-1

CORRECT SYNTAX FOR NMAP: (solved this!) nmap --traceroute --script=firewalk -p1-65535

  • NMAP only scans common ports by default. The full port range must be specified.

I simply needed to add the nmap port scan switches in as those are not arguments that can be passed into the firewalk script. I'm still learning...

Firewalk: firewalk

Current Results of firewalking methods:

Nmap (This list is incomplete but shouldn't be - port 31337 has been opened intentionally on this firewall)

 Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-17 11:15 EDT
 Nmap scan report for
 Host is up (0.0026s latency).
 Not shown: 987 closed ports
 80/tcp    open     http
 111/tcp   filtered rpcbind
 135/tcp   filtered msrpc
 139/tcp   filtered netbios-ssn
 445/tcp   filtered microsoft-ds
 1720/tcp  filtered H.323/Q.931
 2000/tcp  filtered cisco-sccp
 5060/tcp  filtered sip
 49152/tcp filtered unknown
 49153/tcp filtered unknown
 49154/tcp filtered unknown
 49155/tcp filtered unknown
 49156/tcp filtered unknown

 Host script results:
 | firewalk: 
 |_0  tcp       111,135,139,445,1720,2000,5060,49152-49156

 TRACEROUTE (using port 1025/tcp)
 1   3.19 ms


 Firewalk 5.0 [gateway ACL scanner]
 Firewalk state initialization completed successfully. UDP-based scan.
 Ramping phase source port: 53, destination port: 33434
 Hotfoot through using as a metric.
 Ramping Phase:
 1 (TTL  1): *no response*
 2 (TTL  2): *no response*
 25 (TTL 25): *no response*
 Scan aborted: hopcount exceeded.


  • Why doesn't the "Firewalk" tool ever see the target gateway (firewall at Nmap appears to be able to.
  • Why doesn't the Nmap firewalk script show me all the open ports?
  • How do I configure the Nmap firewalk script arguments to ONLY check the firewall for port 31337 TCP? (figured this out! -p31337 or -p1-65535. Duh - see the corrected syntax above)

P.S. also thanks to "Gliffy" for the awesome online network diagramming tool :)

  • Can you try specifying more flags for firewalk(1)? e.g., `firewalk -n -pTCP -S25,53,80,443,465,587,5353'. Maybe it's a name resolution or ICMP/UDP issue?
    – atdre
    Mar 17, 2015 at 18:17
  • Hmmm seems like it fails during ramping phase and the other flags don't matter... Any switches that I can change that would bypass the ramping phase?
    – Shrout1
    Mar 17, 2015 at 18:30
  • Perhaps it would be `firewalk -d 80 -n -pTCP''? See the man page -- freebsd.org/cgi/…
    – atdre
    Mar 17, 2015 at 18:34
  • @atdre Different error now! But that seems like progress... metric responded before target; must not be en route
    – Shrout1
    Mar 17, 2015 at 18:47
  • Great detailed question!
    – Citizen
    Mar 18, 2015 at 20:13

1 Answer 1


According to the man page, firewalk looks to need the following flags in order to properly scan when you are one hop from your gateway (as seen in your pretty Gliffy picture).

firewalk -d 49152 -r

  • Thanks but no dice for me! I am still getting no response in the ramping phase. The ramping phase fails and then firewalk aborts.
    – Shrout1
    Mar 17, 2015 at 18:45
  • @ Shrout1: Did you try putting them both together like the above?
    – atdre
    Mar 17, 2015 at 19:06
  • Yep! Did a copy paste and my ramping phase still fails
    – Shrout1
    Mar 17, 2015 at 19:36
  • Try the -t, -T, and -x flags with values that make sense to your environment as well
    – atdre
    Mar 17, 2015 at 23:26
  • Hey! Tried -t, -x and -T but it still seems like the ramping phase fails.
    – Shrout1
    Mar 18, 2015 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .