Network and Perimeter Hacking · Topic 9 of 9
Evading Firewalls and NAC, Honeypot Detection and Countermeasures
Recognize firewall, NAC and endpoint evasion ideas, the Nmap options involved, how honeypots are detected, and the countermeasures that defeat evasion.
- 5 min
- Firewalking uses TTL to learn firewall rules.
- Nmap
-ffragments,-Ddecoys,-Sspoofs source address,-gsets source port. - Tunneling hides traffic in HTTP, DNS, ICMP, SSH or ACK packets.
What it is
Evasion means getting traffic or activity past a security control without being blocked or alerted. The exam expects you to recognize each idea, name the tools that relate to it, and pick the countermeasure.
This page covers firewalls, network access control (NAC) and endpoint security, then how an attacker tells a real system from a honeypot, and finally the defenses that make evasion fail.
How it works
Evading firewalls
A firewall decides by rules, so evasion looks for traffic those rules permit or inspect poorly.
| Idea | Description |
|---|---|
| Firewalking | Probing with controlled TTL values to learn which ports a firewall allows and map what is behind it |
| Banner grabbing and identification | Learning the firewall or service type to pick an approach |
| IP address spoofing | Using a source address the rules trust |
| Source routing | Dictating the path so packets avoid the firewall (mostly blocked today) |
| Tiny fragments | Splitting headers across fragments so a simple filter cannot read the port |
| Using allowed ports | Sending other traffic over ports such as 80, 443 or 53 |
| Tunneling | Wrapping one protocol inside another, such as HTTP, DNS, ICMP, SSH or ACK tunneling, to hide data inside allowed traffic |
| Proxies and anonymizers | Reaching blocked content through an intermediary |
| Through an external or trusted system | Entering via a partner network or already compromised host |
| Through content or client side | Delivering via email, a web page or an XSS flaw so the connection begins from inside |
Evading NAC and endpoint security
NAC checks devices before they join the network, for example by 802.1X credentials, certificate, posture or MAC address. Endpoint security means antivirus, endpoint detection and response (EDR) and host firewalls.
- Against NAC: cloning the MAC address of an allowed device (such as a printer or phone), plugging into a port used by a trusted device, or taking over a permitted device. MAC based authentication is weak for this reason.
- Against endpoint security: packing or obfuscating malware, living off the land (using built in tools such as PowerShell), disabling or tampering with the agent, and running in memory without writing files.
Tools and options
| Tool or option | Relation to evasion |
|---|---|
Nmap -f and --mtu | Fragment the probe packets |
Nmap -D | Decoys, so the scan appears to come from several addresses as well |
Nmap -S and --spoof-mac | Spoof the source IP or MAC address |
Nmap -g (source port) | Use a trusted source port such as 53 |
Nmap --data-length | Add random data to change packet size |
Nmap --badsum | Send packets with a bad checksum to see whether a device validates them, which can reveal a firewall |
Nmap -T0 or -T1 | Very slow timing to stay under detection thresholds |
| hping3 and packet crafters | Build custom packets with chosen flags, TTL and fragments |
| Proxy and tunneling tools | Carry traffic inside permitted protocols |
Questions name the option and the effect, for example -D for decoys and -f for fragments.
Detecting honeypots
Attackers want to avoid decoys, because touching one alerts the defender. Signs include services that respond too perfectly or all alike, unusual open ports, strange response timing, banners or TCP window sizes that do not match the claimed operating system, and a system with no real data or users. Low interaction honeypots such as Honeyd leave fingerprints in the way they emulate the stack. Probing the honeypot's limits, for example by asking for functions it does not support, can expose it.
Countermeasures
- Firewall and IDS: normalize and reassemble fragments and streams, drop source routed and malformed packets, apply ingress and egress filtering, and use deep packet inspection.
- Tunneling: inspect DNS and HTTP traffic, restrict outbound protocols to what is needed, inspect TLS where policy allows, and alert on unusual volume.
- NAC: use 802.1X with certificates rather than MAC address alone, check device posture, and disable unused ports.
- Endpoint: keep EDR current, restrict scripting tools, apply application allow listing and protect agents from tampering.
- General: log centrally, correlate alerts, tune rules, patch, and test the controls with authorized penetration tests.
A worked example
An analyst sees DNS queries with very long, random looking names to one domain, at a steady rate from a single host. This is DNS tunneling, which hides data inside a protocol that firewalls usually allow. The response is to block or sinkhole the domain, restrict DNS to approved resolvers and alert on query length and volume.
How the exam asks about this
- "Which Nmap option sends packets from several spoofed addresses along with the real one?" ->
-D(decoy scan). - "Which technique wraps forbidden traffic inside an allowed protocol such as DNS or HTTP?" -> Tunneling.
- "Which NAC weakness lets an attacker connect by copying a printer's address?" -> MAC address based authentication (MAC spoofing).
What to remember for the exam
- Firewalking uses TTL to learn firewall rules.
- Nmap
-ffragments,-Ddecoys,-Sspoofs source address,-gsets source port. - Tunneling hides traffic in HTTP, DNS, ICMP, SSH or ACK packets.
- MAC authentication is weak NAC. 802.1X with certificates is stronger.
- Honeypot detection relies on unnatural responses and fingerprint mismatches.
Nmap evasion options help avoid detection but do not make a scan invisible. A well tuned IDS can still correlate slow or fragmented probes.
Common mistakes
Mixing up decoys and spoofing. -D adds fake sources alongside the real one, while -S replaces the source.
Believing a firewall stops tunneling. Without content inspection, an allowed protocol can carry anything.
Assuming endpoint tools see everything. Memory only activity and trusted tools can slip past weak monitoring.
Check yourself
What is firewalking?
Sending packets with controlled TTL values to learn which ports a firewall allows and what lies behind it.
Which control best stops MAC cloning from defeating NAC?
802.1X authentication with certificates, instead of relying on MAC addresses.
How can an attacker suspect a honeypot?
Responses or fingerprints that do not match a real system, or services that behave unnaturally.
Topic 9 of 9 in Network and Perimeter Hacking
Test yourself on Network and Perimeter Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.