[137871] in North American Network Operators' Group
Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs
daemon@ATHENA.MIT.EDU (Manish Karir)
Mon Feb 21 21:29:58 2011
From: Manish Karir <mkarir@merit.edu>
Date: Mon, 21 Feb 2011 21:29:51 -0500
To: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Hi Oleg,
You are correct. We got our default values mixed up. We will correct =
this on the blog post.
Thanks.
-manish
> Hello,
>=20
> > =
http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-=
ripe-ncc-darknets
>=20
> Quote from the link:
>=20
> > Note that in the 37/8, most traffic comes from TTLs around 100. =
These are Linux hosts.
> > The smaller humps are at ~32 (Windows) and ~250 (Solaris).
>=20
> I don't agree. TTL around 100 is most probably Windows hosts with =
initial TTL of 128.
> Everything below 64 can be Linux or FreeBSD. ~250 can be Solaris host =
but Cisco
> IOS also set initial TTL to 255.
>=20
> --=20
> wbr, Oleg.
>=20
