Nmap Hackers: Re: Follow up "nmap" scans

[Aaron Campbell <aaron () cs dal ca>]

On Mon, 22 May 2000, Lance Spitzner wrote:

> 05/20-17:06:45.061034 192.160.13.4:31337 -> 172.16.1.101:1
> TCP TTL:44 TOS:0x10 ID:242 
> ***FRP** Seq: 0xA1D95   Ack: 0x53   Win: 0x400
Another observation: the IP ID of 242 suggests that this tool may have
been developed with Libnet, since this is precisely the IP ID that is used
in many of the sample Libnet "test" programs. I'm guessing route likes the
band "Front 242" and that is why this was chosen.

  . 
 :  Aaron Campbell <aaron () cs dal ca> - [ http://www.biodome.org/~fx ]
  `-------------------------------------------------------------------