On 26 May 2017 at 14:44, <[email protected]> wrote: Hey,
> Regarding OSPF unless you are using virtual-links or sham-links, then all > messages are bound to a directly connected subnet so you can safely > implement the ttl check with 254 (one hop). This is implementation specific and you need to know which one it is. If figuring out it is challenging start with 255 and see if it works, if not, revert to 254. For example in JNPR lo0 filter we verify that ICMP ND has hop-limit 255, because it's done before TTL is decremented, verifying 254 would expose us to ICMP ND attacks from one hop off-link. -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
