Re: INCOMPLETE [ 8bytes] with two src addresses!

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Le ven 27/02/2004 à 19:10, Alexis a écrit :
> at first sight its the first step of a traceroute

I don't think so.
When you traceroute, your first step is your default gateway that sends
you ICMP TTL exceeded back with an IP within your network. We can see :

> SRC=216.200.115.66
> DST=80.5.144.39

As they do not belong to the same network, it's not the first step, but
can be a further one.

Moreover, usual traceroute tools uses ICMP echo (Windows) or UDP (Unix)
probes. We have TCP here. BTW, TCP is damn cool to traceroute when you
target a host with a known opened port (e.g. www.microsoft.com) :)))

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux