Let's say we have a server set up with set to:

iptables -P INPUT DROP

Without any other rules on the input chain.

Ignoring accessibility issues outside of physical server access, what are the methods that an external attacker could use to distinguish between this server and a nullrouted/unused IP address?

1 Answer 1


One can play around with the TTL (or hop limit with IPv6) of packets send to the destination to figure out where the packets gets lost. The idea is that a router will discard a packet if the TTL is reached and send an ICMP TTL exceeded back. This method is for example used by traceroute (tracepath, tracert...). Since null routing will discard the packet on a router before it reaches the target server this difference can be used to distinguish between null routing on a router or discarding the packet on the final server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .