OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: web related oddity
From: Donald McLachlan (donMAINFRAME.DGRC.CRC.CA)
Date: Wed Mar 08 2000 - 12:59:39 CST

> From: Ryan Russell <ryanSECURITYFOCUS.COM>
>
> On Sat, 4 Mar 2000, Richard Bejtlich wrote:
>
> > Hi Don,
> >
> > Assuming the initial TTL for the 24 Feb activity was 255:
> >
> > 255 - 20 (hops) = 235
> >
> > Assuming the initial TTL for the 29 Feb activity was 128:
> >
> > 128 - 20 (hops) = 108
> >
> > The questions is, why was 255 initially set, then later 128?
> > As I understand it, initial TTL is set by the source host,
> > and should only
> > be decremented by routers, not "recalculated." Is this
> > everyone's
> > understanding as well?
> >
>
> Yup. Of course, it is adjustable:
>
> http://support.microsoft.com/support/kb/articles/Q120/6/42.asp?LNG=ENG&SA=ALLKB&FR=0
> (Windows example)
>
> I don't know why someone would change it on purpose, and I'm not aware of
> anything that will change it automatically on one's WIndows box. Perhaps
> he switched OSes? A quick test shows NT server 4.0, Win98 and Redhat 6.0
> all default to 128.
>
> Ryan

The world is not Windows-only. With ndd on Solaris it can be changed on the
fly.

I won't reproduce it here, but http://www.map.ethz.ch/ftp-probleme.htm
shows default TTL values of 30, 32, 60, 64, 128, and 255 for TCP, and
default values of 30, 60, 64, 128 and 255 for different O/S's.

Don