Which command is used to test TCP timestamp handling by a firewall on a specific host?

Which command is used to test TCP timestamp handling by a firewall on a specific host?

• A. hping3 -S 72.14.207.99 -p 80 --tcp-timestamp
• B. hping3 -1 10.0.0.25
• C. hping3 -8 50-60 -S 10.0.0.25 -V
• D. hping3 -F -P -U 10.0.0.25 -p 80

Answer: (A)

Testing how a firewall handles TCP options, specifically the TCP timestamp option, is the key idea. The TCP timestamp is carried in TCP option fields and some devices modify, drop, or strip this option to hide fingerprinting or for efficiency. To assess this on a particular host, you craft a TCP SYN probe that includes the timestamp option and observe how the host and any intervening firewall respond. The best command does exactly that: it uses a TCP SYN packet aimed at a common service port, and it enables the TCP timestamp option to be sent with the packet. The SYN flag indicates you’re probing the start of a connection, the destination port targets a typical service, and the timestamp option is included so you can see whether the firewall preserves, alters, or drops the timestamp in responses. This combination directly tests whether the firewall handles TCP timestamps as part of its filtering behavior. The other options don’t specifically involve TCP timestamps. One option uses ICMP echo, which tests basic reachability rather than how TCP options are treated. The remaining commands select different modes or flags that don’t focus on sending or inspecting the TCP timestamp option, so they wouldn’t reliably reveal how TCP timestamp handling is managed by the firewall.

Testing how a firewall handles TCP options, specifically the TCP timestamp option, is the key idea. The TCP timestamp is carried in TCP option fields and some devices modify, drop, or strip this option to hide fingerprinting or for efficiency. To assess this on a particular host, you craft a TCP SYN probe that includes the timestamp option and observe how the host and any intervening firewall respond.

The best command does exactly that: it uses a TCP SYN packet aimed at a common service port, and it enables the TCP timestamp option to be sent with the packet. The SYN flag indicates you’re probing the start of a connection, the destination port targets a typical service, and the timestamp option is included so you can see whether the firewall preserves, alters, or drops the timestamp in responses. This combination directly tests whether the firewall handles TCP timestamps as part of its filtering behavior.

The other options don’t specifically involve TCP timestamps. One option uses ICMP echo, which tests basic reachability rather than how TCP options are treated. The remaining commands select different modes or flags that don’t focus on sending or inspecting the TCP timestamp option, so they wouldn’t reliably reveal how TCP timestamp handling is managed by the firewall.