2

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64'

qualys output

Number of web servers behind load balancer:
2 - based on IP TTL values
Received 35 SynAck packets with ttl=52
Received 157 SynAck packets with ttl=244

I have run a external hping

root@ip-10-10-10-24:~# hping3 my.site.xxx -S -p 443
HPING my.site.xxx (eth0 00.000.000.000): S set, 40 headers + 0 data bytes
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=0 win=14600 rtt=149.8 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=1 win=14600 rtt=145.6 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=2 win=14600 rtt=145.6 ms
len=44 ip=00.000.000.000 ttl=51 DF id=0 sport=443 flags=SA seq=3 win=14600 rtt=150.0 ms
len=44 ip=00.000.000.000 ttl=55 DF id=0 sport=443 flags=SA seq=4 win=14600 rtt=145.7 ms
len=44 ip=00.000.000.000 ttl=51 DF id=0 sport=443 flags=SA seq=5 win=14600 rtt=145.5 ms

Above output shows me 2 TTLs 51 nd 55. Now how it is possible that 2 TTLs generated, even i have only 1 physical server.

And why TTL value has been changed if i change hping location. Because as per my understanding TTL is defined by destination server/machine, and in my case it should be 64 .

Edit

After further study, we have noticed that they are getting TTL of ubuntu and FW, see following hping results

Hping with protocol

[root@www ~]# hping2 my.site.xxx -S -p 443
HPING my.site.xxx (eth1 00.000.000.000): S set, 40 headers + 0 data bytes
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=0 win=14600 rtt=274.3 ms
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=1 win=14600 rtt=278.0 ms
len=46 ip=00.000.000.000 ttl=56 DF id=0 sport=443 flags=SA seq=2 win=14600 rtt=269.5 ms

Hping without protocol

[root@www ~]# hping2 my.site.xxx -S
HPING my.site.xxx (eth1 00.000.000.000): S set, 40 headers + 0 data bytes
len=46 ip=00.000.000.000 ttl=254 id=64796 sport=0 flags=RA seq=0 win=512 rtt=0.3 ms
len=46 ip=00.000.000.000 ttl=254 id=62708 sport=0 flags=RA seq=1 win=512 rtt=0.2 ms
len=46 ip=00.000.000.000 ttl=254 id=58173 sport=0 flags=RA seq=2 win=512 rtt=0.3 ms
len=46 ip=00.000.000.000 ttl=254 id=34675 sport=0 flags=RA seq=3 win=512 rtt=3.1 ms
  • Have you checked the route ? That could come from a node flipping between two routes: pretty frequent if you're going trough a long distance link – Stephane May 12 '15 at 11:50
  • you are right, but 52 and 244 has huge difference. – Mudasar Yasin May 12 '15 at 12:01
  • It's could simple not the same machine that is answering, that's it: the ICMP ECHO reply (Type=0, Code=0) response is gerenated by the responding machine but if you have an SSL termination proxy in your perimeter, it will be the one replying to TCP 443 SYNs, probably with a very different TTL. – Stephane May 12 '15 at 12:23
  • I have also used other protocol like 80 and 22, but same results. – Mudasar Yasin May 12 '15 at 12:32
1

I think the problem is the routes and protocol used.

Try,

to ping server use Packer equal the '0' in LAN, and internte ping:

try hping use diffent flag:

"-O --tcpoff Set fake tcp data offset. Normal data offset is tcphdrlen / 4."

or

"-2 --udp UDP mode, by default hping2 will send udp to target host's port 0. UDP header tunable options are the following: --baseport, --destport, --keep."

If you send an empty package and it comes back full.

Ne nuntium necare ( do not kill the messenger ). Latin proverbs.

reference: http://linux.die.net/man/8/hping3

http://www.hping.org/manpage.html

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.