TTL field???

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users TTL field???
# 1  
Old 10-03-2001
TTL field???

Hi all,

I wonder, how I can change Time To Live field for icmp packet in Redhat 7.1, kernel 2.4.2-2? I looked up in /proc/sys/net/ipv4 and did find this field in there.
There should be a way to change TTL. If it's in header file, in which one?

Thank you all Smilie
# 2  
Old 10-10-2001

You mean for use with ping or in common??

Why would you want this anyway??

for ping, use: ping -t 'ttl'
# 3  
Old 10-10-2001

I'm talking about TTL field for system itself.

Let's say when someone pings my host, he/she sees different TTL field. I've heard that lots of netscan applications uses this field to determine the type of the system. And for security reasons if you change that field for ping replies comming from your host it eliminates this possibility.

Thank you.Smilie
# 4  
Old 10-10-2001
Offhand I can't think of any (none routing) reason to hack the TTL field or any tools that use the TTL field to scan with the exception of traceroute .

If you can post the exact "netscan application" that uses TTL and why it uses it, then we can give a more accurate reply.

It is certainly possible to return bogus values of processes, including TTL. I'm more interested in understanding why you think you need to do this... thanks.
# 5  
Old 10-10-2001
how can u define a type of system remotely? Conidering closed ports for telnet, ssh, ftp, http, etc. One way to determin the type of the system is to just ping it and and TTL of the returned packet is gonna define system coz it goes basically fixed for different systems. Here what i mean:

64 bytes from icmp_seq=0 ttl=255 time=209 usec

64 bytes from icmp_seq=0 ttl=128 time=1.011 msec

64 bytes from ( icmp_seq=1 ttl=243 time=29.964 msec

In those three examples i can say that runs RedHat Linux 7.1 (ttl=255), - Windows(ME)(ttl=128), - OpenBSD2.8 (maybe 2.9)(ttl=243).
So, if you hack and change TTL for your system some of the scanning software will be cofnfused. So my question still is in what file this field is defined???

Thank you all
# 6  
Old 10-11-2001
OK. Now I understand what you are saying. Some systems, for better or for worse, set the TTL differently and this can be exploited to guess the system kernel, as discussed here:

Because, as the ping manpage says:

The maximum possible value of this field is 255, and most Unix systems
set the TTL field of ICMP ECHO_REQUEST packets to 255. This is why you
will find you can ``ping'' some hosts, but not reach them with telnet(1)
or ftp(1).

In normal operation ping prints the ttl value from the packet it re-
ceives. When a remote system receives a ping packet, it can do one of
three things with the TTL field in its response:

o Not change it; this is what Berkeley Unix systems did before the
4.3BSD-Tahoe release. In this case the TTL value in the received
packet will be 255 minus the number of routers in the round-trip

o Set it to 255; this is what current Berkeley Unix systems do. In
this case the TTL value in the received packet will be 255 minus the
number of routers in the path from the remote system to the pinging

o Set it to some other value. Some machines use the same value for
ICMP packets that they use for TCP packets, for example either 30 or
60. Others may use completely wild values.

You want to change the behavior of a host receiving an ICMP_ECHO_REQUEST by altering the TTL set by the host.

Nice idea!!! There is value to this idea, thanks for pointing this out.

In linux, this value is defined in the ip.h header file in the source distribution:

ip.h:#define MAXTTL 255
One way to change it is to modify the parameter in the ip.h include file and rebuild the kernel.

However, different systems allow you to configure MAXTTL from the command line or in a configuration file like /etc/rc.d.

BTW. This was an EXCELLENT question. I tested two modern linux kernels (TTL, 255) and one Win98 system (TTL, 64).
# 7  
Old 10-11-2001

Great thanks to all of you, esp. to Neo.

I got the answer I wanted.

Best regards
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

awk to adjust coordinates in field based on sequential numbers in another field

I am trying to output a tab-delimited result that uses the data from a tab-delimited file to combine and subtract specific lines. If $4 matches in each line then the first matching sequential $6 value is added to $2, unless the value is 1, then the original $2 is used (like in the case of line... (3 Replies)
Discussion started by: cmccabe
3 Replies

2. Shell Programming and Scripting

Display combination of 4 field uniqe record and along with concatenate 5th and 6th field.

Table ACN|NAME|CITY|CTY|NO1|NO2 115|AKKK|ASH|IND|10|15 115|AKKK|ASH|IND|20|20 115|AKKK|ASH|IND|30|35 115|AKKK|ASH|IND|30|35 112|ABC|FL|USA|15|15 112|ABC|FL|USA|25|20 112|ABC|FL|USA|25|45 i have written shell script using cut command and awk programming getting error correct it and add... (5 Replies)
Discussion started by: udhal
5 Replies

3. Shell Programming and Scripting

Command/script to match a field and print the next field of each line in a file.

Hello, I have a text file in the below format: Source Destination State Lag Status CQA02W2K12pl:D:\CAQA ... (10 Replies)
Discussion started by: pocodot
10 Replies

4. Linux

How do I format a Date field of a .CSV file with multiple commas in a string field?

I have a .CSV file (file.csv) whose data are all enclosed in double quotes. Sample format of the file is as below: column1,column2,column3,column4,column5,column6, column7, Column8, Column9, Column10 "12","B000QRIGJ4","4432","string with quotes, and with a comma, and colon: in... (3 Replies)
Discussion started by: dhruuv369
3 Replies

5. Shell Programming and Scripting

AWK: Pattern match between 2 files, then compare a field in file1 as > or < field in file2

First, thanks for the help in previous posts... couldn't have gotten where I am now without it! So here is what I have, I use AWK to match $1 and $2 as 1 string in file1 to $1 and $2 as 1 string in file2. Now I'm wondering if I can extend this AWK command to incorporate the following: If $1... (4 Replies)
Discussion started by: right_coaster
4 Replies

6. Shell Programming and Scripting

awk, comma as field separator and text inside double quotes as a field.

Hi, all I need to get fields in a line that are separated by commas, some of the fields are enclosed with double quotes, and they are supposed to be treated as a single field even if there are commas inside the quotes. sample input: for this line, 5 fields are supposed to be extracted, they... (8 Replies)
Discussion started by: kevintse
8 Replies

7. Solaris

Set up TTL on process

Is there a way to setup the TTL (Time To Live) on a process. We have many ssh processes that seem to just stack up. These processes do not need a static connection all the time and it might cause problems on our servers. Does anybody know how to setup the TTL on a process? (10 Replies)
Discussion started by: jastanle84
10 Replies

8. Shell Programming and Scripting

Sort alpha on 1st field, numerical on 2nd field (sci notation)

I want to sort alphabetically on the first field and sort in descending numerical order on the 2nd field. With a normal "sort -r -n" it does this: abc ||| 5e-05 ||| bla abc ||| 3 ||| ble def ||| 1 ||| abc def ||| 0.2 ||| def As you can see it ignores the fact that 5e-05 is actually 0.00005... (1 Reply)
Discussion started by: FrancoisCN
1 Replies

9. IP Networking

TTL for IP addr from DNS through C code

Hi All, I know that getaddrinfo() return the multiple IP addresses (if present) for a hostname. But, I want to know how to get the TTL value for this list from DNS. I want to get this TTL value and cache this IP address list for that much time and then again go for DNS resolution if TTL expires. ... (2 Replies)
Discussion started by: softindia
2 Replies
Login or Register to Ask a Question