Why might Firewalk traffic not appear in a sniffer placed deeper in the network when testing a Cisco PIX firewall?

Why might Firewalk traffic not appear in a sniffer placed deeper in the network when testing a Cisco PIX firewall?

• A. Firewalk sets all packets with TTL = one
• B. Firewalk cannot pass through Cisco firewalls
• C. Firewalk cannot be detected by network sniffers
• D. Firewalk sets all packets with a TTL of zero

Answer: (A)

TTL handling in Firewalk probes determines whether the packet ever reaches devices beyond the firewall. Firewalk typically sends probes with TTL set to one, so the packet expires at the first hop—the firewall itself. If the firewall does not forward the packet into the internal network, the traffic never travels deeper, and a sniffer placed behind the firewall will not see it. In other words, the TTL value causes the probe to fail at the boundary rather than traverse into the protected network, which is why Firewalk traffic may not appear further down the line.

TTL handling in Firewalk probes determines whether the packet ever reaches devices beyond the firewall. Firewalk typically sends probes with TTL set to one, so the packet expires at the first hop—the firewall itself. If the firewall does not forward the packet into the internal network, the traffic never travels deeper, and a sniffer placed behind the firewall will not see it. In other words, the TTL value causes the probe to fail at the boundary rather than traverse into the protected network, which is why Firewalk traffic may not appear further down the line.