nanog mailing list archives
Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs
From: Manish Karir <mkarir () merit edu>
Date: Mon, 21 Feb 2011 21:29:51 -0500
Hi Oleg, You are correct. We got our default values mixed up. We will correct this on the blog post. Thanks. -manish
Hello,http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-ripe-ncc-darknetsQuote from the link:Note that in the 37/8, most traffic comes from TTLs around 100. These are Linux hosts. The smaller humps are at ~32 (Windows) and ~250 (Solaris).I don't agree. TTL around 100 is most probably Windows hosts with initial TTL of 128. Everything below 64 can be Linux or FreeBSD. ~250 can be Solaris host but Cisco IOS also set initial TTL to 255. -- wbr, Oleg.
Current thread:
- Traffic to 5/8 and 37/8 - stats on RIPE Labs Mirjam Kuehne (Feb 21)
- Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs Ryan Rawdon (Feb 21)
- Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs "Oleg A. Arkhangelsky" (Feb 21)
- <Possible follow-ups>
- Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs Manish Karir (Feb 21)