A Host That Answers Ping But Nothing Else
During an internal assessment you find host 10.20.4.51 responds to ICMP echo but returns 'filtered' for TCP 22, 80, 443, 445 and 3389 in an nmap SYN scan. A colleague says 'it's firewalled, move on.' You notice the TTL of the ICMP replies is 63 and consistent, the host is in a server VLAN, and the asset register lists it as a 'backup appliance.' You have authorisation to test the internal range but not to cause disruption. You have 3 hours left in the window.
1. What does the TTL of 63 and the consistent all-filtered TCP result most plausibly indicate, and what would you do next?
Read the worked answer
TTL 63 on replies from a host you believe is a Linux appliance is consistent with a default TTL of 64 decremented by one hop - i.e. the replies are plausibly from the host itself, not a middlebox rewriting them. All-filtered TCP plus working ICMP is the classic signature of a host-based firewall with a default-deny inbound policy (or a network ACL on that VLAN), not necessarily a dead host.
Next steps, non-disruptively:
- Re-scan with different probe types to distinguish host-firewall from network-ACL: TCP ACK scan (shows filtered vs unfiltered), a FIN/NULL/Xmas scan, and a UDP scan of likely management ports (161, 623, 443).
- Check whether the appliance exposes an out-of-band management interface on another VLAN; the asset register entry is your lead.
- Confirm from the network team whether the VLAN has an ACL - that is faster and safer than probing.
Do not conclude 'firewalled, move on.' A filtered result is a finding about control placement, and the exam tests whether you interpret evidence rather than accept a colleague's shortcut.
2. How would you report this host given you could not enumerate services?
Read the worked answer
Report it as an observation with a stated limitation, not as 'no findings.' Structure:
- What was observed: ICMP echo replies; all tested TCP ports filtered; TTL consistent with single hop.
- Interpretation: consistent with host-based or network default-deny; service exposure could not be determined within the window.
- Risk: unknown - an unenumerated backup appliance is a potential high-value target (credentials, backup data) and its management plane is unverified.
- Recommendation: confirm ACL/firewall intent with network team, confirm the appliance's management interface is segregated, and schedule a follow-up test with the appliance owner present.
This is assessment-management discipline: an honest 'unknown' is more useful and more defensible than a guess in either direction.