Hacker News new | ask | show | jobs
by saurik 837 days ago
nmap's --traceroute uses this technique (but I don't know if it has a way to cause this long gap; this is just a demonstration that this is an oft-used technique).
1 comments

I just tried that with nmap using --traceroute -p 53 and it used new sequence numbers for each connection, different source ports. It did decrement but never went to 1 and I received responses along the way. NMAP did not set SackOK but it used my home MSS. Maybe someone wrote their own implementation trying to copy NMAP but missed something. Perhaps those servers are good for people trying to learn to write scanners.