[ntp:questions] Re: Strange IP flags set in NTP conversation

Michael Sierchio kudzu at tenebras.com
Wed Oct 15 00:20:46 UTC 2003


Vernon Schryver wrote:

> Do you have an exgesis of DS RFCs showing 0x10 is invalid?

When looked at as a DS field, the upper six bits are the differentiated
services code, and 0x04 is undefined.  0x04 in the upper six bits is
the same as 0x10 in the byte if I have counted my bits correctly.  I
suppose I shouldn't look at these for UDP anyway.  But there is malware
that uses these as a subliminal channel.

> There are plenty of routers that honor the old TOS values.

I suppose those same routers don't handle explicit congestion
notification ?





More information about the questions mailing list