Description
PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL.
References
- 4401 vdb-entry
- 20020331 packet filter fingerprinting(open but closed, closed but filtered) mailing-list
- firewall-rst-fingerprint(8738) vdb-entry