Firewalk aims to map which layer's firewall rules by sending packets with specific TTL values?

Firewalk aims to map which layer's firewall rules by sending packets with specific TTL values?

• A. Application layer
• B. Transport layer
• C. Network layer
• D. Data Link layer

Answer: (C)

Firewalk uses TTL-limited probes to discover how a firewall handles packets at the network boundary. TTL is an IP header field, so this technique operates at the network layer. By sending packets with specific TTL values and observing the responses (or lack thereof), you can infer which traffic is allowed or blocked as traffic travels through the gateway beyond the firewall. That mapping of behavior hinges on IP routing and filtering decisions made at the network layer, not at the application, transport, or data-link layers.

Firewalk uses TTL-limited probes to discover how a firewall handles packets at the network boundary. TTL is an IP header field, so this technique operates at the network layer. By sending packets with specific TTL values and observing the responses (or lack thereof), you can infer which traffic is allowed or blocked as traffic travels through the gateway beyond the firewall. That mapping of behavior hinges on IP routing and filtering decisions made at the network layer, not at the application, transport, or data-link layers.