[ILUG] Firewall - how to read log?

[Kenn Humborg]

On Wed, Jan 19, 2000 at 02:44:25AM -0000, Dermot Hanley wrote:
> > The TTL is not measured in seconds.  It's measured in hops.  Each
> > router or host that forwards the packet is supposed to decrement this
> > field and drop the packet when it hits zero.
> 
> Sorry I should have mentioned hops in there, but...
> 
> Internet Protocol, RFC791, Page 13
> 
> TTL defined...
>     "This field indicates the maximum time the datagram is allowed to
>     remain in the internet system.  If this field contains the value
>     zero, then the datagram must be destroyed.  This field is modified
>     in internet header processing.  The time is measured in units of
>     seconds, but since every module that processes a datagram must
>     decrease the TTL by at least one even if it process the datagram in
>     less than a second, the TTL must be thought of only as an upper
>     bound on the time a datagram may exist.  The intention is to cause
>     undeliverable datagrams to be discarded, and to bound the maximum
>     datagram lifetime."
> 
> So the TTL isn't a strict remaining hop count as nodes can decrease the TTL
> by more than one unit, e.g. depending on the time the packet was queued in a
> router. The "spirit" of the field is to express both a maximum time (hence
> seconds were chosen to express the unit) coupled with maximum node hop.

Cool.  Learnt something new today!

Later,
Kenn