How do I edit my TTL?
Results 1 to 5 of 5

Thread: How do I edit my TTL?

  1. #1
    Junior Member
    Join Date
    Dec 2003
    Posts
    4

    Unhappy How do I edit my TTL?

    As you know, when we actually ping a machine, there's the TTL there. If you have 128 thats mean u have windows running and if you have 64 thats basically Linux.Are there any way I can edit these.Its a good way to mislead attackers right.

  2. #2
    Elite Hacker
    Join Date
    Mar 2003
    Posts
    1,407
    Get a firewall that drops pings or doesn't respond to them, then they won't know if you're there or not. It's kinda security by obscurity, unless you actually configure the firewall correctly, then it's good. I don't know how to edit the response though.

  3. #3
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    In Windows 9x, you can modify it by navigating to HKLM\System\CurrentControlSet\Services\VxD\MSTCP and modifying the DefaultTTL value. In Windows NT/2000/XP, you will have to create a new DWORD Value in HKLM\System\CurrentControlSet\Services\Tcpip\Parameters. The value name will be: DefaultTTL, Data Type: REG_DWORD (DWORD Value), and Value Data: 1-255 hops. I think in Linux it may be ping -t ttl but I'm not positive. Hope this helps a little.
    "It is a shame that stupidity is not painful" - Anton LaVey

  4. #4
    Banned
    Join Date
    Aug 2001
    Location
    Yes
    Posts
    4,424
    If you're not comfortable with manually editing your registry, you could download Dr. TCP from dslreports.com. It's a smal tool that edits some registry settings (TTL, MTU, TCPR,...).

  5. #5
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,325
    Originally posted here by h3r3tic
    Get a firewall that drops pings or doesn't respond to them, then they won't know if you're there or not. It's kinda security by obscurity, unless you actually configure the firewall correctly, then it's good. I don't know how to edit the response though.
    That is what I do.
    I allow it internal on my LAN/WAN but deny it from the internet.

    Not to hijack your thread, but is there any real reason to allow replies?
    (other than troubleshooting connectivity)

    I drop ICMP but send keepalives to my ISP so they don't release/renew my public dynamic IP until I request it.

    There are lots of sites/people now dropping ICMP (including AO) and they all still function fine.
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •