On Fri, Dec 24, 2004 at 09:08:12PM -0500, Chris Brenton wrote: > On Fri, 2004-12-24 at 13:56, Jason Opperisano wrote: > > that all being said--use the ttl match: > > > > iptables [...] -m ttl --ttl-eq 1 [...] > > iptables [...] -m ttl --ttl-lt 1 [...] > > > > i don't condone the use of the above. > > I've rejected TTL's of 5 or less with a host unreachable for many > years and have never had a problem. Its a great way to detect, and > usually prevent, tools such as Firewalk and TCPTrace. Just to back up Chris, I've done a similar thing and never had an issue - and it does mean traceroutes and packets from similar software just get eaten. -- I love getting older. You're happier, you're more well-adjusted, you have more money... and there is one very important thing you realize as you get older: People in their 20's don't know a damn thing about ANYTHING. The only thing that people in their 20's are good for is looking better than people in their 30's and 40's. So if you're in your 20's, you can strike a pose, but shut the f*** up! - Jim David
