mirror of
https://git.FreeBSD.org/ports.git
synced 2024-10-31 21:57:12 +00:00
bad0268e82
is considered "suspicious" with the actual TTL of a test packet sent to that host, to try and detect packet spoofing. It is intended to be used as part of an IDS system.
12 lines
573 B
Plaintext
12 lines
573 B
Plaintext
--- despoof.c.orig Sat Sep 2 18:34:37 2000
|
|
+++ despoof.c Sat Sep 2 18:34:45 2000
|
|
@@ -150,7 +150,7 @@
|
|
|
|
if (targetaddr == ip->ip_src.s_addr)
|
|
{
|
|
- if (((inquery == 1) && (icmp->icmp_type == ICMP_ECHOREPLY)) || ((inquery == 2) && (icmp->icmp_type == ICMP_TIMESTAMPREPLY)) || ((inquery == 3) && (sport == ntohs(tcphdr->th_dport))))
|
|
+ if (((inquery == 1) && (icmp->icmp_type == ICMP_ECHOREPLY)) || ((inquery == 2) && (icmp->icmp_type == ICMP_TSTAMPREPLY)) || ((inquery == 3) && (sport == ntohs(tcphdr->th_dport))))
|
|
{
|
|
if (ttlval == ip->ip_ttl)
|
|
{
|