Snort mailing list archives
TTL LIMIT Exceeded
From: "Sheahan, Paul" <Paul.Sheahan () priceline com>
Date: Thu, 25 Mar 2004 15:52:35 -0500
I'm seeing "(spp_stream4) TTL LIMIT Exceeded {TCP}" alerts in Snort. Occasionally I see web requests arriving at my web server with a TTL of 5. Then the following packets decrement down to 4, 3, 2, 1, then zero, which generates a TTL LIMIT EXCEEDED. Just curious if anyone knows what the intent would be in purposely send web requests with a low TTL to generate this message? Thanks
Current thread:
- TTL LIMIT Exceeded Sheahan, Paul (Mar 25)
- RE: TTL LIMIT Exceeded Mark E. Donaldson (Mar 26)
- Re: TTL LIMIT Exceeded Jason (Mar 26)
- RE: TTL LIMIT Exceeded Alejandro Flores (Mar 27)
- RE: TTL LIMIT Exceeded Mark E. Donaldson (Mar 26)