OS detection with ICMP.

[Ironic]

This may be a stupid question but what does it mean if the TTL is 125?

[chsh]

It means the packet could have gone 125 hops more to get to its destination.
Probably that it was set to 128 and the host replying was 3 hops away.

[PacketThirst]

TTL stands for Time To Live ... every Packet that goes out has a life time or TTL value.If the
packet doen't reach the destination in a time less than its TTL value, It becomes invalid (Right ??). When a packet travels from one node to another its called a hop (right ?).

[hobbdebub]

That is right. Ex.) A TTL of 255 means that the packet should time out in something like 4.25 minutes but this is not true. The TTL is decremented everytime it makes a hop, so the 4 minute thing is not neccesarily true in all cases because sometimes it takes less than a second for the packet to be processed and sometimes it may take more time.

[seiferaistlinlp]

Most of the time it is under a second. Traceroute, for example, almost always takes less than a second. You have to be careful when pinging systems. There are ways to detect people pinging your system.

It's not a bad idea to go and pick up Ankit Fadia's Network Security: A Hacker's Perspective. It's a good book and it oulines the ICMP protocol in full very nicely. Detailed, too. But yeah.

I need help with un-XORing binary numbers (is it possible?), if anyone's interested.

[alphabetarian]

You know, it's funny this thread comes up. I've been doing a lot of pinging at work all summer, making sure machines are up and such, and I noticed the difference in TTL fields between Windows and various *nix boxes. Never thought much of it until now.

But here's another thought, kind of along the same lines. Anyone else notice how ping packets sent from different OSes are different sizes?

alpha

[cgkanchi]

Whatever you do, please don't pick up Ankit Fadia's book. If it's anything like the first one, it's just plagarised material taken from freely available internet sources. If you want to learn about the ICMP protocol, here's a list of links that might be useful.

RFC 792 - The definitive guide to ICMP
http://www.networksorcery.com/enp/protocol/icmp.htm
http://cities.lk.net/trproto.html

Cheers,
cgkanchi

[seiferaistlinlp]

You're probably right cgkanchi, but it's a good source nontheless. It has all those things in one place, which is a good reference.

[chsh]

A slowly incrementing TTL value is how traceroute works. It increments the TTL from 1 to the max (default 30 on most systems) until the target host and the destination host are the same. It captures the time it took for its initial packet to return the icmp-ttl-expired which is how it generates the list of intervening hosts and ping times it displays.