Hello.
I’m working on some small project to separate spoofed and not spoofed traffic using a TTL. Let’s say I have incoming UDP packets, same IP but different TTL. However, first packet always coming with good TTL so I want to make a rule on RAW table of firewall to accept packets only with proper TTL (as we know TTL is a bit different for every IP address). Adding IP to a address list doesn’t work as there is no TTL field. I was thinking about using sniffer to save only headers of incoming packets and then parse it ever few seconds to import them to my firewall. However, I can’t find any examples if there’s any chance to combine scripting & packet sniffer. Any clues?
Regards,
Jakub