Hi,
'
Ok, so how can I locate a printer behind a firewall? Is it possible to enumerate the subnet behind a router ( even if a connection has not been marked)?

There are many ways of attempting to accomplish this task. Additionally, there are many forums dedicated to the discussion and dissemination of this information. While much of it is used by penetration testers for legal purposes, much of it is also used for illicit purposes. LQ does not generally permit this type of discussion - so I can only say that googling various RFCs and setting up your own pen-test lab will be the way to find your answers. If you need help setting up a pen-test environment there are many resources on the subject, and they can be used to build entire enterprise level networks which allow the tester to perform various attacks (such as internal network routing).

2 members found this post helpful.

Hey thanks man. Could you possibly point me ( a little bit more ) in the right direction. I will try to search out pen-test labs and see what comes up. I dont want to do this for illegal purposes, just want a better understanding.

Thanks

without being too specific in methodology, I'd point out - RFC 791 (The Internet Protocol version 4) has source routing options. Finding the right way of using this information can be revealing about how an internal network is setup (assuming LS/SS RR is allowed). Additionally, client side / social giveaways are possible.