Hi all,

I wonder, how I can change Time To Live field for icmp packet in Redhat 7.1, kernel 2.4.2-2? I looked up in /proc/sys/net/ipv4 and did find this field in there.
There should be a way to change TTL. If it's in header file, in which one?

Thank you all

You mean for use with ping or in common??

Why would you want this anyway??

for ping, use: ping -t 'ttl'

I'm talking about TTL field for system itself.

Let's say when someone pings my host, he/she sees different TTL field. I've heard that lots of netscan applications uses this field to determine the type of the system. And for security reasons if you change that field for ping replies comming from your host it eliminates this possibility.

Thank you.

Offhand I can't think of any (none routing) reason to hack the TTL field or any tools that use the TTL field to scan with the exception of traceroute .

If you can post the exact "netscan application" that uses TTL and why it uses it, then we can give a more accurate reply.

It is certainly possible to return bogus values of processes, including TTL. I'm more interested in understanding why you think you need to do this... thanks.

how can u define a type of system remotely? Conidering closed ports for telnet, ssh, ftp, http, etc. One way to determin the type of the system is to just ping it and and TTL of the returned packet is gonna define system coz it goes basically fixed for different systems. Here what i mean:

#ping foo1.com
64 bytes from 65.30.119.70: icmp_seq=0 ttl=255 time=209 usec
...

#ping foo2.com
64 bytes from 192.168.0.3: icmp_seq=0 ttl=128 time=1.011 msec
...

#ping foo3.com
64 bytes from ns.donnelly.cc.ks.us (208.129.6.92): icmp_seq=1 ttl=243 time=29.964 msec
...

In those three examples i can say that foo1.com runs RedHat Linux 7.1 (ttl=255), foo2.com - Windows(ME)(ttl=128), foo3.com - OpenBSD2.8 (maybe 2.9)(ttl=243).
So, if you hack and change TTL for your system some of the scanning software will be cofnfused. So my question still is in what file this field is defined???

Thank you all

OK. Now I understand what you are saying. Some systems, for better or for worse, set the TTL differently and this can be exploited to guess the system kernel, as discussed here:

http://www.geocrawler.com/archives/3...0/9/0/4279406/

Because, as the ping manpage says:


You want to change the behavior of a host receiving an ICMP_ECHO_REQUEST by altering the TTL set by the host.

Nice idea!!! There is value to this idea, thanks for pointing this out.

In linux, this value is defined in the ip.h header file in the source distribution:

One way to change it is to modify the parameter in the ip.h include file and rebuild the kernel.

However, different systems allow you to configure MAXTTL from the command line or in a configuration file like /etc/rc.d.

BTW. This was an EXCELLENT question. I tested two modern linux kernels (TTL, 255) and one Win98 system (TTL, 64).

Great thanks to all of you, esp. to Neo.

I got the answer I wanted.

Best regards