Hi All,

i've been playing with different IP setting available in the linux 
kernel ( 2.4.18 ) and found a stange behaviour with 
/usr/src/linux/net/ipv4/ip_default_ttl :
the value that you set here is not taken into account in the following 
cases :

- ICMP reply ( of any kind )
- TCP RST .

since the sockets used in this cases are the one created at the init of 
the given protocols, and therefore the ttl value used are the one that 
are setup at boot time and not the one that you will set later when 
using the sysctl or the proc interface.

I'm not sure that this has been left out on purpose since it will defeat 
the goal of changing the default ttl to confuse OS fingerprinting 
softwares.
Therefore, i've made a small patch ( against kernel 2.4.18 ) that will 
change the behaviour and make the default ttl be used in these cases.

I hope it will be useful to some of you ....
Regards

PS : i'm not on the list so please CC me if you reply to this email.

-- 
Charles-Edouard Ruault
PGP Key ID 4370AF2D