TTL field??? Post: 8390

Sponsored Content

Top Forums UNIX for Advanced & Expert Users TTL field??? Post 8390 by Neo on Wednesday 10th of October 2001 10:23:15 PM

10-10-2001

Administrator

OK. Now I understand what you are saying. Some systems, for better or for worse, set the TTL differently and this can be exploited to guess the system kernel, as discussed here:

http://www.geocrawler.com/archives/3...0/9/0/4279406/

Because, as the ping manpage says:

Quote:

The maximum possible value of this field is 255, and most Unix systems
set the TTL field of ICMP ECHO_REQUEST packets to 255. This is why you
will find you can ``ping'' some hosts, but not reach them with telnet(1)
or ftp(1).

In normal operation ping prints the ttl value from the packet it re-
ceives. When a remote system receives a ping packet, it can do one of
three things with the TTL field in its response:

o Not change it; this is what Berkeley Unix systems did before the
4.3BSD-Tahoe release. In this case the TTL value in the received
packet will be 255 minus the number of routers in the round-trip
path.

o Set it to 255; this is what current Berkeley Unix systems do. In
this case the TTL value in the received packet will be 255 minus the
number of routers in the path from the remote system to the pinging
host.

o Set it to some other value. Some machines use the same value for
ICMP packets that they use for TCP packets, for example either 30 or
60. Others may use completely wild values.

You want to change the behavior of a host receiving an ICMP_ECHO_REQUEST by altering the TTL set by the host.

Nice idea!!! There is value to this idea, thanks for pointing this out.

In linux, this value is defined in the ip.h header file in the source distribution:

Quote:

ip.h:#define MAXTTL 255

One way to change it is to modify the parameter in the ip.h include file and rebuild the kernel.

However, different systems allow you to configure MAXTTL from the command line or in a configuration file like /etc/rc.d.

BTW. This was an EXCELLENT question. I tested two modern linux kernels (TTL, 255) and one Win98 system (TTL, 64).

Neo

View Public Profile for Neo

Visit Neo's homepage!

Find all posts by Neo

9 More Discussions You Might Find Interesting

1. IP Networking

TTL for IP addr from DNS through C code

Hi All, I know that getaddrinfo() return the multiple IP addresses (if present) for a hostname. But, I want to know how to get the TTL value for this list from DNS. I want to get this TTL value and cache this IP address list for that much time and then again go for DNS resolution if TTL expires. ...

2. Shell Programming and Scripting

Sort alpha on 1st field, numerical on 2nd field (sci notation)

I want to sort alphabetically on the first field and sort in descending numerical order on the 2nd field. With a normal "sort -r -n" it does this: abc ||| 5e-05 ||| bla abc ||| 3 ||| ble def ||| 1 ||| abc def ||| 0.2 ||| def As you can see it ignores the fact that 5e-05 is actually 0.00005...

3. Solaris

Set up TTL on process

Is there a way to setup the TTL (Time To Live) on a process. We have many ssh processes that seem to just stack up. These processes do not need a static connection all the time and it might cause problems on our servers. Does anybody know how to setup the TTL on a process?

4. Shell Programming and Scripting

awk, comma as field separator and text inside double quotes as a field.

Hi, all I need to get fields in a line that are separated by commas, some of the fields are enclosed with double quotes, and they are supposed to be treated as a single field even if there are commas inside the quotes. sample input: for this line, 5 fields are supposed to be extracted, they...

5. Shell Programming and Scripting

AWK: Pattern match between 2 files, then compare a field in file1 as > or < field in file2

First, thanks for the help in previous posts... couldn't have gotten where I am now without it! So here is what I have, I use AWK to match $1 and $2 as 1 string in file1 to $1 and $2 as 1 string in file2. Now I'm wondering if I can extend this AWK command to incorporate the following: If $1...

6. Linux

How do I format a Date field of a .CSV file with multiple commas in a string field?

I have a .CSV file (file.csv) whose data are all enclosed in double quotes. Sample format of the file is as below: column1,column2,column3,column4,column5,column6, column7, Column8, Column9, Column10 "12","B000QRIGJ4","4432","string with quotes, and with a comma, and colon: in...

7. Shell Programming and Scripting

Command/script to match a field and print the next field of each line in a file.

Hello, I have a text file in the below format: Source Destination State Lag Status CQA02W2K12pl:D:\CAQA ...

8. Shell Programming and Scripting

Display combination of 4 field uniqe record and along with concatenate 5th and 6th field.

Table ACN|NAME|CITY|CTY|NO1|NO2 115|AKKK|ASH|IND|10|15 115|AKKK|ASH|IND|20|20 115|AKKK|ASH|IND|30|35 115|AKKK|ASH|IND|30|35 112|ABC|FL|USA|15|15 112|ABC|FL|USA|25|20 112|ABC|FL|USA|25|45 i have written shell script using cut command and awk programming getting error correct it and add...

9. Shell Programming and Scripting

awk to adjust coordinates in field based on sequential numbers in another field

I am trying to output a tab-delimited result that uses the data from a tab-delimited file to combine and subtract specific lines. If $4 matches in each line then the first matching sequential $6 value is added to $2, unless the value is 1, then the original $2 is used (like in the case of line...

LEARN ABOUT V7

traceroute

TRACEROUTE(1)                                                      User Commands                                                     TRACEROUTE(1)

NAME

       traceroute - Trace the route to a host

SYNOPSIS

       traceroute [OPTION...] HOST

DESCRIPTION

       Print the route packets trace to network host.

       -f, --first-hop=NUM
              Set initial hop distance, that is the time-to-live.

       -g, --gateways=GATES
              List of gateways for loose source routing.

       -I, --icmp
              Use ICMP ECHO as probe.

       -m, --max-hop=NUM
              Set maximal hop count (default is 64).

       -M, --type=METHOD
              Use METHOD (icmp or udp) for traceroute operations, defaulting to udp.

       -p, --port=PORT
              Use destination PORT port (default is 33434).

       -q, --tries=NUM
              Send NUM probe packets per hop (default is 3).

       --resolve-hostnames
              Resolve hostnames.

       -t, --tos=NUM
              Set type of service (TOS) to NUM.

       -w, --wait=NUM
              Wait NUM seconds for response (default is 3).

       -?, --help
              Give this help list.

       --usage
              Give a short usage message.

       -V, --version
              Print program version.

GNU inetutils                                                       2015-05-15                                                       TRACEROUTE(1)