[question] fairphone's IP packets seems to have a non (*nix) default TTL (108 instead of 64)

WeAreFairphone / android_device_fairphone_FP3

Android / LineageOS 16 device tree for Fairphone 3

46 stars 7 forks source link

[question] fairphone's IP packets seems to have a non (*nix) default TTL (108 instead of 64) #34

Open jimixxperez opened 3 years ago

jimixxperez commented 3 years ago

Hi, is this on purpose? Cheers

dk1978 commented 3 years ago

No idea. Where and how did you observe this?

Edit: meanwhile, checked this using adb:

FP3:/ # cat /proc/sys/net/ipv4/ip_default_ttl
64

Same value as in the kernel source:

$ grep -e IPDEFTTL include/uapi/linux/ip.h 
#define IPDEFTTL    64

So, whatever you are seeing is from overriding this, apparently?

jimixxperez commented 3 years ago

thanks a lot, working in the cyber security field and observed a device with a fairphone mac-vendor and a 107 ttl (assumed to a colleague's phone).

dk1978 commented 3 years ago

Interesting, but maybe the MAC address was changed/spoofed?

jimixxperez commented 3 years ago

it's quiet unlikely... we are quiet certain about it. Interestingly he also explicitly told me not having changed any settings on the device. I'll further investigate this and report back any interesting insights. Thanks a lot for the quick reply.