Traffic to 5/8 and 37/8 - stats on RIPE Labs
Manish Karir
mkarir at merit.edu
Tue Feb 22 02:29:51 UTC 2011
Hi Oleg,
You are correct. We got our default values mixed up. We will correct this on the blog post.
Thanks.
-manish
> Hello,
>
> > http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-ripe-ncc-darknets
>
> Quote from the link:
>
> > Note that in the 37/8, most traffic comes from TTLs around 100. These are Linux hosts.
> > The smaller humps are at ~32 (Windows) and ~250 (Solaris).
>
> I don't agree. TTL around 100 is most probably Windows hosts with initial TTL of 128.
> Everything below 64 can be Linux or FreeBSD. ~250 can be Solaris host but Cisco
> IOS also set initial TTL to 255.
>
> --
> wbr, Oleg.
>
More information about the NANOG
mailing list