dmiessler.com | grep understanding - Latest Comments in TTL Caging: How to Fight Malware Using Reduced TTL Values

Re: TTL Caging: How to Fight Malware Using Reduced TTL Values

danielrm26 — Sun, 18 May 2008 15:59:22 -0000

Guys,

I agree that this would just be another layer if one was already doing the blocking at the firewall. That's a valid point. I just think it's an interesting and elegant way of approaching the problem.

Re: TTL Caging: How to Fight Malware Using Reduced TTL Values

Kenneth R Swain II — Sat, 17 May 2008 23:43:05 -0000

Would not a good egress rule be far more beneficial? I love the way he was thinking, but this would be very hard to maintain. Plus I do not even believe possible in environments that include WAN links such as MPLS or others. One argument that you could use would be that your work place will not let you use good egress rules. If that is they case it seems far fetched that they would let you do this as it would make trouble shooting more difficult.

Re: TTL Caging: How to Fight Malware Using Reduced TTL Values

kuza55 — Sat, 17 May 2008 21:25:58 -0000

And the benefit of using this instead of a firewall is what? That anyone who wants to can circumvent it? That doesn't seem like a very useful idea to me...Especially since you're still relying on being able to identify bad traffic going through the proxy.

P.S. IDS' suck.