Re: multiple packets from client with decreasing TTL

To: beacon@dast.nlanr.net
Subject: Re: multiple packets from client with decreasing TTL
From: "Charles R. Anderson" <cra@WPI.EDU>
Date: Thu, 22 Jul 2004 08:54:48 -0400
Content-disposition: inline
Content-type: text/plain; charset=us-ascii
In-reply-to: <77F2FAF1D3546D41888AA4DEC6AF13AF0D34B95E@lsntex3.clyne.swan.ac.uk>
Mail-followup-to: beacon@dast.nlanr.net
References: <77F2FAF1D3546D41888AA4DEC6AF13AF0D34B95E@lsntex3.clyne.swan.ac.uk>
Reply-to: beacon@dast.nlanr.net
Sender: owner-beacon@dast.nlanr.net
User-agent: Mutt/1.4.1i

On Thu, Jul 22, 2004 at 01:17:33PM +0100, Williams S.R. wrote:
> I seem to be seeing a beacon client sending multiple copies of the same
> packet to the beacon multicast group - with decreasing TTL. This appears
> to be coming from the host itself rather than being caused by routing
> anomaly.

I was seening some weird stuff too, like TTL exceeded or fragment
reassembly time exceeded on our IDS system.  It was coming from one
system at UIUC running the beacon.  When I tried to look at it closer,
it stopped...

Follow-Ups:
- Re: multiple packets from client with decreasing TTL
  - From: "Charles R. Anderson"

References:
- multiple packets from client with decreasing TTL
  - From: "Williams S.R."

Prev by Date: multiple packets from client with decreasing TTL
Next by Date: Re: multiple packets from client with decreasing TTL
Previous by thread: multiple packets from client with decreasing TTL
Next by thread: Re: multiple packets from client with decreasing TTL

Other Mailing lists | Author Index | Date Index | Subject Index | Thread Index