Re: ICMP time exceed in-transit packets

[Alain.Thivillon () HSC FR (Alain Thivillon)]

Chris Brenton <cbrenton () SOVER NET> écrivait (wrote) :

> So the attacker transmits the above packet. While in transit, the TTL
> drops to zero. The router receiving the TTL 0 packet realizes it can not
> forward it and issues a time exceeded (ICMP type 11) packet back to the
> spoofed source address. So what you are seeing in your logs is the error
> code generated by the spoofed packets when the TTL expires.

Well, you are saying someone is tracerouting you. Congratulations :)

--
Unix is ending in 13897 days, 7 hours, 9 min, 55 sec : save your buffers