Firewall Wizards mailing list archives
firewalk meets nmap - TTL (fwd)
From: Lance Spitzner <lance () spitzner net>
Date: Sat, 4 Nov 2000 21:13:33 -0600 (CST)
I sent this off to the nmap-list, was wondering what all the firewall weenies on board here thought. :0 -- Lance Spitzner http://www.enteract.com/~lspitz ---------- Forwarded message ---------- Date: Thu, 2 Nov 2000 23:00:53 -0600 (CST) From: Lance Spitzner <lance () spitzner net> To: nmap-hackers () insecure org Subject: firewalk meets nmap - TTL I'm not sure if anyone has thought of this, but this would be a REALLY cool feature for auditing firewall rulebases. Say you want to determine what ports a firewall allows through, what ports are NOT filtered. Have the option with nmap to set the TTL on the packets it sends. I set the TTL to be the same as the amount of hops to the firewall I am scanning. If the packet is filtered by the firewall, then it is dropped and nothing is sent back. However, if the packet is accepted by the firewall (and the port is not filtered), the firewall will attempt to forward it. However, the TTL will now be zero and the firewall will respond with ICMP TTL expired error message. You can now map what ports are passed through the firewall (i.e not filtered) without a packet ever passing through the firewall. firewalk meets nmap thoughts? -- Lance Spitzner http://www.enteract.com/~lspitz _______________________________________________ firewall-wizards mailing list firewall-wizards () nfr com http://www.nfr.com/mailman/listinfo/firewall-wizards
Current thread:
- firewalk meets nmap - TTL (fwd) Lance Spitzner (Nov 06)
- Re: firewalk meets nmap - TTL (fwd) Chris Boscolo (Nov 08)
- Re: firewalk meets nmap - TTL (fwd) Chuck Swiger (Nov 08)
- Re: firewalk meets nmap - TTL (fwd) Mikael Olsson (Nov 08)
- <Possible follow-ups>
- RE: firewalk meets nmap - TTL (fwd) Kalat, Andrew (ISS Atlanta) (Nov 08)