Stefan: Why?
Neal: sting seems to be reporting results 10 times higher than ping
Stefan: That's weird, let me look..... (pause) They're the same on
yahoo...
Neal: try xoom.com
Stefan: How strange, they are different... I wonder why that is....
To cut a long story short it turns out the there is a frobulator (firewall,
lb, shaper, etc...) that answers icmp echo request packets on behalf of
xoom.com. It has its own value of ip_id. I also has its own ttl base.
This suggests that we could use the sting/ping combination to detect web
sites behind firewalls.
- Stefan