From: Alla Bezroutchko (alla@scanit.be)
Date: Wed Jan 14 2004 - 06:01:55 EST
Paul Johnston wrote:
> Hi,
>
> I've come accross the following anomoloies while auditing a network, can
> anyone help explain what they are:
> 3) Ports where the TTL is different on the SYN reply to the rest of the
> connection. ipid's also imply that different hosts are handling the SYN
> and the rest of the connection.
I've seen that on a server behind a Cisco PIX firewall with SYN flood
protection enabled. The firewall handles connection setup itself and
once the handhsake is complete, establishes the connection with the
server behind it. If the handshake is not complete the server never sees
any of it.
Alla.
---------------------------------------------------------------------------
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:45 EDT