OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: route oddness
From: Marc Slemko (marcsZNEP.COM)
Date: Thu Apr 13 2000 - 16:13:49 CDT

On Wed, 12 Apr 2000, Mike wrote:

> Been seeing some funny things in my routing table (HP-UX 10.20). Was
> hoping someone could give me some ideas about them. What bothers me is
> that they are all outside the US and seem to be from the same IP
> classes. Are these traces of an exploit or normal traffic? Any ideas would
> be helpful.

Nothing unusual there. Just how HPUX stores PMTU values discovered
via path MTU discovery. See http://users.worldgate.ca/~marcs/mtu/
for a description of PMTU-D; it is focused on what can break PMTU-D,
but it also describes what it is and how it works.

HPUX simply stores a route with the MTU info and a certain expiry.