Re: getting different ttl values for the same IP

[Maciek Dudek <cneither () gmail com>]

> Hmm, well the first packet is a TTL exceeded message.  Do you suppose
> the RFCs call for a high TTL for that specific message, since one would
> want to be sure it doesn't also die due to TTL issues?  This is just
> speculation, but it would make sense...  The max TTL is of course 255,
> so maybe that box is 25 hops away?

Away from what? everyone doesn't have the same, 255 ttl. It is the max
value but not mandatory. So it doesn't mean that box is 25 hops away,
of course it can be, but we can measure it by checking the ttl of our
echo request packet sent to that host. That value of ttl point out how
far that box is. Of course, a couple of measurements is needed if we
want pinpoint, cuz the routing way can changed.

cheers
Maciek Dudek aka arkin

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------