Using tcpdump/wireshark to capture low TTL values

We suspected a network anonaly where packets were expiring because of a low TTL value. You can capture packets with a given TTL value with the following tcpdump filter:

tcpdump -v ip and 'ip[8]<32'

This will filter out any packet with a TTL lower than 32, because the TTL byte is the 8th byte in the IP header.

Leave A Reply
All content licensed under the Creative Commons License