Hi Oleg, You are correct. We got our default values mixed up. We will correct this on the blog post.
Thanks. -manish > Hello, > > > http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-ripe-ncc-darknets > > Quote from the link: > > > Note that in the 37/8, most traffic comes from TTLs around 100. These are > > Linux hosts. > > The smaller humps are at ~32 (Windows) and ~250 (Solaris). > > I don't agree. TTL around 100 is most probably Windows hosts with initial TTL > of 128. > Everything below 64 can be Linux or FreeBSD. ~250 can be Solaris host but > Cisco > IOS also set initial TTL to 255. > > -- > wbr, Oleg. >