Host Discovery with Strict TCP Firewall Filtering
A penetration tester was assigned to scan a large network range to find live hosts. The network is known for using strict TCP filtering rules on its firewall, which may obstruct common host discovery techniques. The tester needs a method that can bypass these firewall restrictions and accurately identify live systems. What host discovery technique should the tester use?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core trap is assuming standard ICMP or TCP methods work; the key insight is that 'strict TCP filtering' implies blocking SYN/ACK, making UDP the viable alternative for discovery.
This question addresses host discovery techniques when a firewall enforces strict TCP filtering. It establishes that UDP Ping Scan is the preferred method to bypass TCP-based restrictions and identify live hosts.
Many candidates choose C (TCP SYN Ping Scan) because it is stealthy and commonly used, but they fail to account for the specific constraint of 'strict TCP filtering' which blocks these packets.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct technique is D (UDP Ping Scan). The question explicitly states the network uses 'strict TCP filtering rules.' This means the firewall is actively dropping or rejecting TCP packets, including SYN requests. Since TCP and ICMP are blocked, the tester must use UDP. Sending UDP probes to closed ports elicits an ICMP Port Unreachable message, confirming the host is alive while potentially bypassing the strict TCP filter.Why the Other Options Are Wrong
Option A (ICMP Timestamp) and Option B (ICMP ECHO) rely on ICMP, which is typically restricted in high-security environments alongside strict TCP filters. Option C (TCP SYN) is the most common host discovery method but fails here because the firewall specifically blocks TCP traffic. If the TCP filter is strict, SYN packets will be dropped, resulting in no response.Community Comment Notes
The community consensus strongly favors D, with users noting that keywords like 'strict TCP filtering' rule out TCP and often ICMP options. One user noted that UDP can sometimes bypass restrictions where others fail. Another commenter correctly identified that since TCP is filtered, TCP-related scans are invalid choices.Exam Strategy
Always look for negative constraints in the question stem. If a firewall is described as 'strictly filtering' a protocol, you must eliminate all options relying on that protocol. In this case, 'Strict TCP' eliminates A, B, and C, leaving UDP as the only logical choice.
Frequently Asked Questions
Why not use TCP SYN scan if it's stealthy?
Stealth doesn't matter if the packet is blocked. Strict TCP filtering drops SYN packets, so you get no response to distinguish live from dead hosts.
Does UDP ping always work against firewalls?
Not always, but it is the best option here. While some firewalls block UDP, many allow outbound UDP responses (like ICMP Port Unreachable) which reveals the host.