Re: hiding routers

[Felix Lindner <fx () sabre-labs com>]

Hi,

On Wed, 18 Apr 2007 04:24:37 -0400
"Kristian Hermansen" <kristian.hermansen () gmail com> wrote:
> How common is it that a router does not decrement the TTL of packets,
> such that it is unable to be identified using traceroute?  Choosing
> not to decrement the TTL causes the next router to appear as the hop,
> but the current router to remain hidden.  How does one commonly
> identify such hidden routers in an automated fashion?  And is it
> policy for any organizations to actually do this, or only with certain
> packet types?

it is common for Firewalls (ie Cisco PIX does this), less common for routers.

There is no general way to identify such routers. If the router has two
interfaces with different MTUs, Path discovery could be used. In general the
approach would be similar to the TTL "trick" used by traceroute: try to
generate packets that would cause the "hidden" router in question to return
error messages (ICMP) to you. In many cases, such a packet can be identified
but there is no universal solution AFAIK.

cheers
FX

-- 
SABRE Labs GmbH            | Felix 'FX' Lindner <fx () sabre-labs com> 
http://www.sabre-labs.com  | GSM: +49 171 7402062
Wrangelstrasse 4           | PGP: A740 DE51 9891 19DF 0D05  
10997 Berlin, Germany      |      13B3 1759 C388 C92D 6BBB
HRB 105213 B, Amtsgericht Charlottenburg, GF Felix Lindner

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/