Penetration Testing mailing list archives
Re: getting different ttl values for the same IP
From: Technica Forensis <forensis.technica () gmail com>
Date: Fri, 30 Dec 2005 10:18:04 -0500
10.10.10.10;400 ms (TTL=106) - Echo Reply;401 ms (TTL=102) - Echo Reply;400 ms (TTL=102) - Echo Reply;(Unknown);
This run is the one that bothers me... why does it change from 106 to 102? Where did the alleged four extra hops come from? Changing from 255-230=25 to 128-103=25 makes sense if a load balancer is going between two systems of different OSes, which is good for survivability. But, assuming the max of 255 and 128 are the starting points, why does the number of hops change from 25 to 22 to 26? Assuming that the network was laid out by a sane person and doesn't have 4 or 5 extra devices in the way that are only sometimes used, obfuscation is the only thing that seems to make sense. A load balancer switching between a few systems that have different maxes that then passes through a firewall that subtracts 1-10 hops, randomly, in order to hide the layout of the network behind it. I don't suppose at some point you'll be allowed to physically touch the box and tell us the real answer, will you? ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Re: getting different ttl values for the same IP, (continued)
- Re: getting different ttl values for the same IP Tim (Dec 28)
- Re: getting different ttl values for the same IP Maciek Dudek (Dec 28)
- Re: getting different ttl values for the same IP Maciek Dudek (Dec 28)
- Re: getting different ttl values for the same IP ilaiy (Dec 28)
- Re: getting different ttl values for the same IP Joachim Schipper (Dec 28)
- RE: getting different ttl values for the same IP Sahir Hidayatullah (Dec 28)
- Re: getting different ttl values for the same IP Pieter Danhieux (Dec 28)
- RE: getting different ttl values for the same IP berg (Dec 29)
- Re: getting different ttl values for the same IP Thierry Zoller (Dec 29)
- Re: getting different ttl values for the same IP Paul Robertson (Dec 29)
- Re: getting different ttl values for the same IP Technica Forensis (Dec 31)
- Re: getting different ttl values for the same IP pentest (Dec 29)
- Re: getting different ttl values for the same IP Tim (Dec 28)