On Fri, 2004-12-24 at 13:30, Jorge Agrelo wrote: > Hi Folks > > Anybody can help to write an iptables rule to drop/reject packets > with a TTL of 1 or 0 ? coupla things: if your routing firewall receives a packet with a TTL = 1 that is not destined for itself, it will drop the packet and reply to the sender with an ICMP Time Exceeded, TTL expired in transit (type 11 code 0). there is no "valid" way to receive a packet with a TTL of 0. for that matter, unless the attacker is on the same segment as you, it's pretty tough to receive an "invalid" packet with a TTL of 0; unless the attacker controls every router between himself and you. this has nothing to do with netfilter or firewalling--it is part of standard routing. that all being said--use the ttl match: iptables [...] -m ttl --ttl-eq 1 [...] iptables [...] -m ttl --ttl-lt 1 [...] i don't condone the use of the above. -j -- "Homer no function beer well without." --The Simpsons
