ICMP Traceroute Network Topology Discovery
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
Suricata
