[Dshield] RE: 1524 -> 1524 TTLS

Smith, Donald Donald.Smith at qwest.com
Wed Jul 10 16:44:34 GMT 2002


I guess I should also ask for the hop count to 
the scanners when available. So if you can
include the hop counts. I think the range is 128 - 100 but
if a box is 29 hops away someone might see ttl < 99.
Thanks to all who have responded.


Donald.Smith at qwest.com GCIA
QIS/WWN Security
303-226-9939 Office
720-320-1537 cell

> -----Original Message-----
> From: John Sage [mailto:jsage at finchhaven.com]
> Sent: Wednesday, July 10, 2002 10:26 AM
> To: Smith, Donald 
> Cc: list at dshield.org; intrusions at incidents.org
> Subject: Re: 1524 -> 1524 TTLS
> 
> 
> On Wed, Jul 10, 2002 at 08:05:10AM -0600, Smith, Donald  wrote:
> > Has anyone seen 1524->1524 packets with a ttl over 128 or 
> less then 100?
> > 
> 
> Donald:
> 
> No.
> 
> I have four only (!), 1524->1524, and the ttl's are within the range
> 108 to 119..
> 
> 
> - John
> -- 
> "Obviously, we do not want to leave zombies around."
> 
> PGP key      http://www.finchhaven.com/pages/gpg_pubkey.html
> Fingerprint  FE 97 0C 57 08 43 F3 EB 49 A1 0C D0 8E 0C D0 BE 
> C8 38 CC B5 
> 




More information about the list mailing list