Networker: Using the TTL doesn't work I'm afraid. At least it doesn't work against a linksys 'cos i tried it a week or so ago. It seems that the linksys rebuilds the packet ans provides a new TTL itself. Thus the linksys seems to be the originating machine.
Yeah u'r write, that restriction had been pointed in the paper linked by instronics & that's what Imeant by saying "(provided NAT device decrements the TTL)."
What I meant, in my previous post, is just that the sflow tool do nothing more that a simple traceroute (except maybe a log utility).