Snort mailing list archives
Re: Interesting traffic...
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Wed, 27 Feb 2002 16:54:08 +1300
On Tue, Feb 26, 2002 at 10:19:24PM -0500, Ashley Thomas wrote:
OTOH, the TTL:63 implies one-hop from the sender - so that implies a LAN host...only routers while forwarding reduces the TTL,right ? so TTL 63 means that it passed one router. So it cant be on the same subnet !!
That's what I said wasn't it? "implies one-hop from the sender"? one-hop means one hop. I don't know of any other network that is one-hop away from any host on our LAN - other than another LAN subnet.... [LAN's aren't normally just one subnet these days - esp. for people on this list] That's assuming the TTL is real, etc, etc -- Cheers Jason Haar Information Security Manager Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Interesting traffic... Mark Mason (Feb 26)
- Re: Interesting traffic... Ashley Thomas (Feb 26)
- Re: Interesting traffic... Jason Haar (Feb 26)
- Re: Interesting traffic... Ashley Thomas (Feb 26)
- Re: Interesting traffic... Jason Haar (Feb 26)
- Re: Interesting traffic... Ashley Thomas (Feb 26)
- <Possible follow-ups>
- Re: Interesting traffic... Scott Taylor (Feb 26)
- RE: Interesting traffic... Mark Mason (Feb 27)