[Dshield] 1524 -> 1524 TTLS

Tim Rushing dshield at threenorth.com
Wed Jul 10 15:43:22 GMT 2002


At 08:05 AM 7/10/02 -0600, you wrote:
>Has anyone seen 1524->1524 packets with a ttl over 128 or less then 100?

Jun  9 15:57:11 mybox kernel: Packet log: input REJECT eth0 PROTO=6 
128.242.238.148:1524 a.b.c.194:1524 L=40 S=0x00 I=39426 F=0x0000 T=30 SYN 
(#74)
Jun  9 15:57:11 mybox kernel: Packet log: input REJECT eth0 PROTO=6 
128.242.238.148:1524 a.b.c.195:1524 L=40 S=0x00 I=39426 F=0x0000 T=30 SYN 
(#74)
Jun  9 15:57:11 mybox kernel: Packet log: input REJECT eth0 PROTO=6 
128.242.238.148:1524 a.b.c.196:1524 L=40 S=0x00 I=39426 F=0x0000 T=30 SYN 
(#74)
Jun  9 15:57:11 mybox kernel: Packet log: input REJECT eth0 PROTO=6 
128.242.238.148:1524 a.b.c.197:1524 L=40 S=0x00 I=39426 F=0x0000 T=30 SYN 
(#74)


That's it out of about 40 total scans in the last month or so.

      ---Tim Rushing




More information about the list mailing list