On Fri, 2004-12-24 at 13:56, Jason Opperisano wrote: > > this has nothing to do with netfilter or firewalling--it is part of > standard routing. Agreed. TTL of 0 should never happen unless the upstream router has gone rogue or has been compromised. > that all being said--use the ttl match: > > iptables [...] -m ttl --ttl-eq 1 [...] > iptables [...] -m ttl --ttl-lt 1 [...] > > i don't condone the use of the above. I've rejected TTL's of 5 or less with a host unreachable for many years and have never had a problem. Its a great way to detect, and usually prevent, tools such as Firewalk and TCPTrace. The lowest starting TTL you will see in the wild today is 32. Even then, that's only certain networking hardware as most OS's are 64 or higher. Given that most hosts are 14-18 hops away from each other on the Internet, filtering TTL's or 5 or less should cause zero problems with legitimate traffic. HTH, Chris
