2

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64'

qualys output

Number of web servers behind load balancer:
2 - based on IP TTL values
Received 35 SynAck packets with ttl=52
Received 157 SynAck packets with ttl=244

I have run a external hping

root@ip-10-10-10-24:~# hping3 my.site.xxx -S -p 443
HPING my.site.xxx (eth0 00.000.000.000): S set, 40 headers + 0 data bytes
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=0 win=14600 rtt=149.8 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=1 win=14600 rtt=145.6 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=2 win=14600 rtt=145.6 ms
len=44 ip=00.000.000.000 ttl=51 DF id=0 sport=443 flags=SA seq=3 win=14600 rtt=150.0 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=4 win=14600 rtt=145.7 ms
len=44 ip=00.000.000.000 ttl=51 DF id=0 sport=443 flags=SA seq=5 win=14600 rtt=145.5 ms

Above output shows me 2 TTLs 51 nd 55. Now how it is possible that 2 TTLs generated, even i have only 1 physical server.

And why TTL value has been changed if i change hping location. Because as per my understanding TTL is defined by destination server/machine, and in my case it should be 64 .

Edit

After further study, we have noticed that they are getting TTL of ubuntu and FW, see following hping results

Hping with protocol

[root@www ~]# hping2 my.site.xxx -S -p 443
HPING my.site.xxx (eth1 00.000.000.000): S set, 40 headers + 0 data bytes
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=0 win=14600 rtt=274.3 ms
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=1 win=14600 rtt=278.0 ms
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=2 win=14600 rtt=269.5 ms

Hping without protocol

[root@www ~]# hping2 my.site.xxx -S
HPING my.site.xxx (eth1 00.000.000.000): S set, 40 headers + 0 data bytes
len=46 ip=00.000.000.000 ttl=254 id=64796 sport=0 flags=RA seq=0 win=512 rtt=0.3 ms
len=46 ip=00.000.000.000 ttl=254 id=62708 sport=0 flags=RA seq=1 win=512 rtt=0.2 ms
len=46 ip=00.000.000.000 ttl=254 id=58173 sport=0 flags=RA seq=2 win=512 rtt=0.3 ms
len=46 ip=00.000.000.000 ttl=254 id=34675 sport=0 flags=RA seq=3 win=512 rtt=3.1 ms
4
  • Have you checked the route ? That could come from a node flipping between two routes: pretty frequent if you're going trough a long distance link
    – Stephane
    Commented May 12, 2015 at 11:50
  • you are right, but 52 and 244 has huge difference. Commented May 12, 2015 at 12:01
  • It's could simple not the same machine that is answering, that's it: the ICMP ECHO reply (Type=0, Code=0) response is gerenated by the responding machine but if you have an SSL termination proxy in your perimeter, it will be the one replying to TCP 443 SYNs, probably with a very different TTL.
    – Stephane
    Commented May 12, 2015 at 12:23
  • I have also used other protocol like 80 and 22, but same results. Commented May 12, 2015 at 12:32

1 Answer 1

1

I think the problem is the routes and protocol used.

Try,

to ping server use Packer equal the '0' in LAN, and internte ping:

try hping use diffent flag:

"-O --tcpoff Set fake tcp data offset. Normal data offset is tcphdrlen / 4."

or

"-2 --udp UDP mode, by default hping2 will send udp to target host's port 0. UDP header tunable options are the following: --baseport, --destport, --keep."

If you send an empty package and it comes back full.

Ne nuntium necare ( do not kill the messenger ). Latin proverbs.

reference: http://linux.die.net/man/8/hping3

http://www.hping.org/manpage.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .