FW: The DF Bit Playground (Identifying Sun Solaris & OpenBSD OSs)

[Andrew Thomas <blink () eye2eye net>]

just in case some of you didn't notice this or aren't on bugtraq
Andrew Thomas
<eye2eye> digital distillers (Pty) Ltd
office: +27-(0)21-4889820
facsimile: +27-(0)21-4889830
mobile: +27-(0)83-3184070


                        -----Original Message-----
                From:   Aaron Campbell [mailto:aaron () MONKEY ORG]
<mailto:[mailto:aaron () MONKEY ORG]> 
                Sent:   Tuesday, September 12, 2000 11:34 PM
                To:     BUGTRAQ () SECURITYFOCUS COM
<mailto:BUGTRAQ () SECURITYFOCUS COM> 
                Subject:        Re: The DF Bit Playground (Identifying Sun
Solaris & OpenBSD OSs)

                On Tue, 12 Sep 2000, Ofir Arkin wrote:
                > The tcpdump trace below illustrates the reply an OpenBSD
2.7 box produced
                > for an ICMP Echo Request.

                [snip]
                > [root@godfather bin]# ./sing -echo Host_Address
                > SINGing to www.openbsd.org <http://www.openbsd.org>
(IP_Address): 16 data bytes
                > 16 bytes from IP_Address: icmp_seq=0 DF! ttl#3 TOS=0
time67.314 ms

                You're assuming that www.openbsd.org
<http://www.openbsd.org>  is actually running OpenBSD. It's not. Due to
bandwidth requirements and such, it's hosted by the University of Alberta
and this box is actually running SunOS.
                Reviewing tcpdump output on a Linux box pinging an OpenBSD
2.8-beta box, I see no DF bit set in the IP header.

                ---
                Aaron Campbell (aaron () monkey org <mailto:aaron () monkey org>
|| aaron () openbsd org <mailto:aaron () openbsd org> )

--------------------------------------------------
For help using this (nmap-hackers) mailing list, send a blank email to 
nmap-hackers-help () insecure org . List run by ezmlm-idx (www.ezmlm.org).