Firewalk

Firewalk is an active reconnaissance network security tool designed to identify what TCP or UDP protocols a gateway or firewall will allow through. It is particularly useful for network security assessments, such as penetration tests, where understanding firewall rules and ACLs is crucial.

The tool works by sending packets with manipulated TTL values to map the network path and detect filtering behavior. It does not require reaching the ultimate destination host, only that it is downstream from the gateway being tested. This makes it efficient for probing firewall configurations without deep network traversal.

Firewalk is relevant for pentests and security audits of packet filtering devices, providing insights into open ports and protocol permissions beyond the gateway.

Firewalk sends TCP or UDP packets with a TTL one hop greater than the targeted gateway. If allowed, the gateway forwards them to the next hop where they expire, eliciting an ICMP_TIME_EXCEEDED message. If dropped, no response is received. It ramps up hop counts like traceroute to find the correct TTL for packets to expire one hop beyond the gateway. Once bound to the gateway hop count, it scans specified ports, analyzing responses to determine open ports or filtering.