Daniel Hartmeier said: > Since the ID is chosen randomly, it wouldn't make much sense to allow > filtering based on it as criteria, so you can just watch the IDs. If you > see more IDs like 256, 512, etc. (powers of 2), that means the sender is > not generating them randomly, I guess.
Thanks to all for the very informative responses. I've c&p a few secs from my pftop output below... (my IP addr = X). As I said most (I'm guessing 95% +) have the 256, 512, 768 or 1024 "ID Field" :). Thanks, Jay icmp In 67.33.112.89:768 X:768 0:0 1 9 2 184 icmp In 67.33.159.163:512 X:512 0:0 8 2 2 184 icmp In 67.32.17.228:512 X:512 0:0 12 0 2 184 icmp In 67.30.41.245:768 X:768 0:0 3 7 2 184 icmp In 67.33.107.213:512 X:512 0:0 3 7 2 184 icmp In 67.32.213.95:512 X:512 0:0 4 6 2 184 icmp In 67.33.122.207:768 X:768 0:0 1 9 2 184 icmp In 67.34.243.82:1024 X:1024 0:0 1 9 2 184 icmp In 67.30.123.99:512 X:512 0:0 5 5 2 184 icmp In 67.30.19.226:768 X:768 0:0 12 0 2 184
