Re: INCOMPLETE [ 8bytes] with two src addresses!

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Friday 27 February 2004 19:17, Cedric Blancher wrote:
> Le ven 27/02/2004 à 19:41, Alexis a écrit :
> > in traceroute ttl=1 is only for the first packet (thats what i said
> > about the first step)
>
> Yep, but...
> The router which has raised the TTL exceeded error always receive the
> packet with TTL=1. So, when you get an ICMP TTL exceeded, the TTL in
> the citation is always 1 (well, should be).

Unless the router is decrementing the TTL field by more than 1 for each 
packet.  For example, if it decrements by 5 and it receives any packet 
with a TTL <= 4, it will raise TTL exceeded.

I believe this is possible, but most likely not common.

David



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux