dmiller e658387ff4 More robustly handle asymmetric routes in IPv6 OS detection ...

The HLIM feature was miscategorizing probes where the route from the
target was shorter than the route to the target. This would result, e.g.
in a distance calculation of 9 and a received hop limit of 57. Adding
the distance to the hop limit remaining gave a guessed initial hop limit
of 66, which would exceed the "64" category. In IPv4 fingerprints, we
put the TG test (initial TTL guess) as a range of 5 up or down from the
expected number to allow for this and other interference. This patch
does the same for IPv6.

2015-05-02 13:25:49 +00:00

106 KiB

Raw Blame History

View Raw