Host Discovery Behind Restrictive Firewall
Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network. Which of the following host discovery techniques must he use to perform the given task?
Community Votes
80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the distinction between Layer 2 (ARP) and Layer 3/4 (TCP/UDP) scanning when dealing with firewalls. The common trap is assuming that because a firewall restricts traffic, one must use advanced TCP scans, ignoring that ARP works locally before the firewall.
This question tests host discovery techniques for finding devices hidden by restrictive firewalls. The correct technique is the ARP ping scan, which operates at Layer 2 and bypasses IP-based firewall restrictions.
Many learners choose ACK flag probe scan or UDP scan, mistakenly believing these are better for evading firewalls. They fail to recognize that ARP operates at the link layer and is often the only way to discover hosts on the local segment if ICMP is blocked.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B (ARP ping scan). ARP (Address Resolution Protocol) operates at Layer 2 (Data Link Layer) of the OSI model. Firewalls typically filter traffic at Layer 3 (Network) and Layer 4 (Transport). By using an ARP ping scan, the ethical hacker sends ARP requests to resolve IP addresses to MAC addresses within the local subnet. Since this traffic does not traverse the router/firewall interface in the same way as IP packets, it is often effective for discovering active devices on the local network segment, even if the firewall is restrictive regarding IP-based protocols like ICMP.Why the Other Options Are Wrong
A (UDP scan) and D (TCP Maimon scan) are port scanning techniques that operate at higher layers and are likely to be blocked or filtered by a restrictive firewall. C (ACK flag probe scan) is used to determine stateful firewall rules by sending packets without establishing a connection; however, it still relies on IP routing and may not effectively discover all hosts, especially if the target is on a different subnet or if the firewall drops unacknowledged packets entirely. Furthermore, ARP is specifically designed for local network discovery, making it the most appropriate tool for the scenario described.Community Comment Notes
Community comments largely support Option B, noting that ARP works at Layer 2 and is rarely blocked by firewalls compared to IP-based scans. One user highlighted that ARP is highly effective for host discovery within the same subnet. Another commenter correctly identified that the other options are primarily for port scanning rather than host discovery. While some users argued for ACK scans, the consensus aligns with the technical reality that ARP is the standard method for local network discovery when IP-based methods are obstructed.Exam Strategy
When a question mentions 'restrictive firewall' and 'host discovery', always consider Layer 2 techniques like ARP first if the context implies local network access. Remember that firewalls filter IP traffic, so non-IP protocols like ARP can bypass these restrictions on the local segment.
Frequently Asked Questions
Why is ARP ping scan better than ICMP ping?
ICMP pings are often blocked by restrictive firewalls. ARP operates at Layer 2 and is used for local address resolution, making it less likely to be filtered.
Can ACK scan discover hosts behind a firewall?
ACK scans can infer firewall rules but are not reliable for comprehensive host discovery, especially compared to ARP on the local segment.