0

We want to set sensitive TCP/UDP Ports at low TTL/HOP Leaving other ttl/hop at 128 default

data center = 3 Priv net = 8 Internet = 128 default

Ssh 22 = 8 (internal hop max) Rdp 3389 = 8 Http 80 = 128 (internet) Https 443 = 128 Epmap 135 = 8 MSSQL 1433 = 3 (inside data center)

Netsh can change default, but we want to change defaults by port.

Might we be able to

1.) Use netsh to set low hop, ttl=8 2.) use listen command to open let's say port 22. 3.) use netsh to change ttl=3 4.) use listen command to open port 1433,

Etc?

I have no idea if such a thing would work but I'm pretty desperate to set a particular hop TTL for particular TCPUDP ports.

.net 5 can do it for a developed app,

Just not sure how to get it set for a particular general app like SSH or RDP or MSSQL.

I have not found any way to set ports dynamically to the TTL to protect how far it travels.

Appreciate any of your thoughts. I am trying to do this using some form of script batch or setting as opposed to writing and running code. We want to be able to do this without adding any programs.

Bill Alderson
  • 1
  • 1
    Run a firewall on that machine and create an egress rule to rewrite the TTL based on the port. It should work for any flow that doesn't use IPsec Authenticated Headers. – Spiff Nov 17 '20 at 00:04
  • 1
    I should also mention that relying on TTLs to try to keep packets from passing a certain network boundary is probably a bad idea. Put ACLs on the routers at those boundaries to disallow flows that shouldn't cross those boundaries. That is, use a real network security policy enforcement mechanism to enforce network security policies. Don't try to jerry-rig a network security policy solution out of an unrelated mechanism like TTLs. – Spiff Nov 17 '20 at 00:10
  • What Windows firewall might rewrite ttl? That would be good to know and try. And thanks for your concern. We set hop in ADDITION to firewall settings... in case tge firewall might have errors at times. Thus hop saves tge day secondarily. – Bill Alderson Nov 18 '20 at 01:06

0 Answers0