full-disclosure - Re: hiding routers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070418121520.292ecd93.fx@sabre-labs.com>
Date: Wed, 18 Apr 2007 12:15:20 +0200
From: Felix Lindner <fx@...re-labs.com>
To: "Kristian Hermansen" <kristian.hermansen@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: hiding routers

Hi,

On Wed, 18 Apr 2007 04:24:37 -0400
"Kristian Hermansen" <kristian.hermansen@...il.com> wrote:
> How common is it that a router does not decrement the TTL of packets,
> such that it is unable to be identified using traceroute?  Choosing
> not to decrement the TTL causes the next router to appear as the hop,
> but the current router to remain hidden.  How does one commonly
> identify such hidden routers in an automated fashion?  And is it
> policy for any organizations to actually do this, or only with certain
> packet types?

it is common for Firewalls (ie Cisco PIX does this), less common for routers.

There is no general way to identify such routers. If the router has two
interfaces with different MTUs, Path discovery could be used. In general the
approach would be similar to the TTL "trick" used by traceroute: try to
generate packets that would cause the "hidden" router in question to return
error messages (ICMP) to you. In many cases, such a packet can be identified
but there is no universal solution AFAIK.

cheers
FX

-- 
SABRE Labs GmbH            | Felix 'FX' Lindner <fx@...re-labs.com> 
http://www.sabre-labs.com  | GSM: +49 171 7402062
Wrangelstrasse 4           | PGP: A740 DE51 9891 19DF 0D05  
10997 Berlin, Germany      |      13B3 1759 C388 C92D 6BBB
HRB 105213 B, Amtsgericht Charlottenburg, GF Felix Lindner

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/