Re: Some unusual network features

[Alla Bezroutchko <alla () scanit be>]

Paul Johnston wrote:
> Hi,
>
> I've come accross the following anomoloies while auditing a network, can 
> anyone help explain what they are:

> 3) Ports where the TTL is different on the SYN reply to the rest of the 
> connection. ipid's also imply that different hosts are handling the SYN 
> and the rest of the connection.

I've seen that on a server behind a Cisco PIX firewall with SYN flood 
protection enabled. The firewall handles connection setup itself and 
once the handhsake is complete, establishes the connection with the 
server behind it. If the handshake is not complete the server never sees 
any of it.

Alla.


---------------------------------------------------------------------------
----------------------------------------------------------------------------