Snort mailing list archives
RE: TTL LIMIT Exceeded
From: "Mark E. Donaldson" <markee () bandwidthco com>
Date: Fri, 26 Mar 2004 19:25:47 -0800
Any chance this could be caused by a router loop? _____ From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Sheahan, Paul Sent: Thursday, March 25, 2004 12:53 PM To: snort-users () lists sourceforge net Subject: [Snort-users] TTL LIMIT Exceeded I'm seeing "(spp_stream4) TTL LIMIT Exceeded {TCP}" alerts in Snort. Occasionally I see web requests arriving at my web server with a TTL of 5. Then the following packets decrement down to 4, 3, 2, 1, then zero, which generates a TTL LIMIT EXCEEDED. Just curious if anyone knows what the intent would be in purposely send web requests with a low TTL to generate this message? Thanks
Current thread:
- TTL LIMIT Exceeded Sheahan, Paul (Mar 25)
- RE: TTL LIMIT Exceeded Mark E. Donaldson (Mar 26)
- Re: TTL LIMIT Exceeded Jason (Mar 26)
- RE: TTL LIMIT Exceeded Alejandro Flores (Mar 27)
- RE: TTL LIMIT Exceeded Mark E. Donaldson (Mar 26)