Note TTLTTL: The time specified that the datagram allows the number of network segments allowed before being discarded. The TTL is set by the send host to prevent the packet from constantly cycle on the IP interconnection network. When forwarding the IP packet, the router is required to reduce TTL at least 1. The ICMP packet type involved in PIN is an ICMP request echo (ICMP Echo Request) a ICMP Echo Reply, the TTL field value can help us identify the operating system type. UNIX and class UNIX operating system ICMP returns a TTL field value of 255compaq TRU64 5.0 ICMP Emotion Answer TTL field value is 64 Microsoft Windows NT / 2K operating system ICMP returns a TTL field value of 128 Microsoft Windows 95 operating system The TTL field value of ICMP returns an attachment is 32
Of course, the returned TTL value is the same, but in some cases, the TTL field value of the special Linux kernel 2.2.x & 2.4.x ICMP returned response is 64FreeBSD 4.1, 4.0, 3.4; Sun Solaris 2.5.1, 2.6, 2.7 , 2.8; OpenBSD 2.6, 2.7, NetBSDHP UX 10.20ICMP Election The TTL field value of 255Windows 95/98 / 98seWindows meicmp returns a TTL field value of 32Windows NT4 WRKSWINDOWS NT4 ServerWindows 2000icmp returns a TTL field value of 128 In this way, we can identify the operating system TTLLINUX 64WIN2K / NT 128Windows Series 32Unix Series 255
