Description
IPFilter 3.4.25 and earlier sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs.
References
- 20020331 packet filter fingerprinting(open but closed, closed but filtered) mailing-list
- 4403 vdb-entry
- firewall-rst-fingerprint(8738) vdb-entry