Re: multiple packets from client with decreasing TTL

To: beacon@dast.nlanr.net
Subject: Re: multiple packets from client with decreasing TTL
From: "Charles R. Anderson" <cra@WPI.EDU>
Date: Thu, 22 Jul 2004 09:02:37 -0400
Content-disposition: inline
Content-type: text/plain; charset=us-ascii
In-reply-to: <20040722125448.GA14203@angus.ind.WPI.EDU>
Mail-followup-to: beacon@dast.nlanr.net
References: <77F2FAF1D3546D41888AA4DEC6AF13AF0D34B95E@lsntex3.clyne.swan.ac.uk> <20040722125448.GA14203@angus.ind.WPI.EDU>
Reply-to: beacon@dast.nlanr.net
Sender: owner-beacon@dast.nlanr.net
User-agent: Mutt/1.4.1i

On Thu, Jul 22, 2004 at 08:54:48AM -0400, Charles R. Anderson wrote:
> I was seening some weird stuff too, like TTL exceeded or fragment
> reassembly time exceeded on our IDS system.  It was coming from one
> system at UIUC running the beacon.  When I tried to look at it
> closer, it stopped...

Oh, and I noticed when I stopped receiving packets from it, the beacon
server still reported that my beacon could see its traffic (green "0"
in the Central Loss cell).  This stayed there for what seemed like a
long time.  Is this a bug in the beacon?  How long should a beacon
client remain in the table with a green "0" after it can no longer be
heard?

Follow-Ups:
- Re: multiple packets from client with decreasing TTL
  - From: Mitch Kutzko

References:
- multiple packets from client with decreasing TTL
  - From: "Williams S.R."
- Re: multiple packets from client with decreasing TTL
  - From: "Charles R. Anderson"

Prev by Date: Re: multiple packets from client with decreasing TTL
Next by Date: beacon 0.9.58 dies after a while - broken pipe?
Previous by thread: Re: multiple packets from client with decreasing TTL
Next by thread: Re: multiple packets from client with decreasing TTL

Other Mailing lists | Author Index | Date Index | Subject Index | Thread Index