Snort mailing list archives

TTL LIMIT Exceeded

From: "Sheahan, Paul" <Paul.Sheahan () priceline com>
Date: Thu, 25 Mar 2004 15:52:35 -0500

I'm seeing "(spp_stream4) TTL LIMIT Exceeded  {TCP}" alerts in Snort.

 

Occasionally I see web requests arriving at my web server with a TTL of
5. Then the following packets decrement down to 4, 3, 2, 1, then zero,
which generates a TTL LIMIT EXCEEDED. Just curious if anyone knows what
the intent would be in purposely send web requests with a low TTL to
generate this message?

 

Thanks

Current thread:

TTL LIMIT Exceeded Sheahan, Paul (Mar 25)
- RE: TTL LIMIT Exceeded Mark E. Donaldson (Mar 26)
  - Re: TTL LIMIT Exceeded Jason (Mar 26)
  - RE: TTL LIMIT Exceeded Alejandro Flores (Mar 27)