One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64'
qualys output
Number of web servers behind load balancer:
2 - based on IP TTL values
Received 35 SynAck packets with ttl=52
Received 157 SynAck packets with ttl=244
I have run a external hping
root@ip-10-10-10-24:~# hping3 my.site.xxx -S -p 443
HPING my.site.xxx (eth0 00.000.000.000): S set, 40 headers + 0 data bytes
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=0 win=14600 rtt=149.8 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=1 win=14600 rtt=145.6 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=2 win=14600 rtt=145.6 ms
len=44 ip=00.000.000.000 ttl=51 DF id=0 sport=443 flags=SA seq=3 win=14600 rtt=150.0 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=4 win=14600 rtt=145.7 ms
len=44 ip=00.000.000.000 ttl=51 DF id=0 sport=443 flags=SA seq=5 win=14600 rtt=145.5 ms
Above output shows me 2 TTLs 51 nd 55. Now how it is possible that 2 TTLs generated, even i have only 1 physical server.
And why TTL value has been changed if i change hping location. Because as per my understanding TTL is defined by destination server/machine, and in my case it should be 64 .
Edit
After further study, we have noticed that they are getting TTL of ubuntu and FW, see following hping results
Hping with protocol
[root@www ~]# hping2 my.site.xxx -S -p 443
HPING my.site.xxx (eth1 00.000.000.000): S set, 40 headers + 0 data bytes
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=0 win=14600 rtt=274.3 ms
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=1 win=14600 rtt=278.0 ms
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=2 win=14600 rtt=269.5 ms
Hping without protocol
[root@www ~]# hping2 my.site.xxx -S
HPING my.site.xxx (eth1 00.000.000.000): S set, 40 headers + 0 data bytes
len=46 ip=00.000.000.000 ttl=254 id=64796 sport=0 flags=RA seq=0 win=512 rtt=0.3 ms
len=46 ip=00.000.000.000 ttl=254 id=62708 sport=0 flags=RA seq=1 win=512 rtt=0.2 ms
len=46 ip=00.000.000.000 ttl=254 id=58173 sport=0 flags=RA seq=2 win=512 rtt=0.3 ms
len=46 ip=00.000.000.000 ttl=254 id=34675 sport=0 flags=RA seq=3 win=512 rtt=3.1 ms