Deep Packet Inspection

Can you repost this on 1st April next year please?

Pretty much all consumer internet connections make use of NAT otherwise how would you connect your 15 PCs to your home broadband? Without NAT the internet would have run out of IP addresses a long long time ago.

And besides TTL and NAT have nothing to do with each other?

NAT translates your connection to allow multiple internal IPs to use one external facing IP. TTL is to do with the maximumn hops a packet can go through until the packet gets dropped.

I wasnt saying that the ISP was making use of NAT ofcourse I know they use it I apologise if I wasn't clear they are using NAT detection and one way of detecting NAT is hop count computation reading the IP header using the TTL.

And besides TTL and NAT have nothing to do with each other?

Network Address Translators decrement IP TTL values of all translated packets. An article written by Peter Phaal "Detecting NAT Devices using sFlow" addresses this issue.

In the article Phaal writes, "The NAT detection technique is based on two observations about the IP TTL (Time To Live) field.

1. Host operating systems have characteristic initial TTL values. This property of individual operating system implementations of TCP/IP is well known and can be used as part of a "fingerprint" to identify the operating system that a host is running merely by examining its traffic. The technique is well described in Passive OS Fingerprinting Details and Techniques by Toby Miller.
2. NAT devices or gateways decrement the TTL on packets that they forward."

Greetings,

If I remember correctly, all routers should decrement the TTL even if they're not running NAT.

I guess I should go read the article.

-David

kovar is correct that all routers should decrement TTL.

But, for example bridges, firewalls, proxies, and reverse proxies can be set to or not to decrease TTL.

This can be done on routers too. JUNOS command is "no-propagate-ttl". I forgot the IOS. Some will even allow increase of TTL…

If you can set TTL to 63, what stops you from setting it to 65, it is a byte long after all.

Network Address Translators decrement IP TTL values of all translated packets. An article written by Peter Phaal "Detecting NAT Devices using sFlow" addresses this issue.

http//www.forensicswiki.org/wiki/NAT_detection

If and only if they follow the rules.

Network Address Translators decrement IP TTL values of all translated packets. An article written by Peter Phaal "Detecting NAT Devices using sFlow" addresses this issue.

http//www.forensicswiki.org/wiki/NAT_detection