4 ms·

I'm seeing "x.x.x.x is POOR: 26 queries in 2.1 seconds from 24 ports with std dev 135.99" Is this good or bad?

• tlrobinson 18y ago
  I think that's fine, as long as it's not "1 ports". The idea is that the patches randomize the source port, which the attacker won't know, so you'll ignore any responses that don't match. (it's still possible to guess the correct port number, but much much harder) If you get "1 ports" for 26 queries then it's always using the same port (bad!), but if you get somewhere around 26 ports for 26 queries then it's using random ports (since it's random it won't always be 26 distinct ports, which is why it sometimes shows 24 or 25) I'm no expert but this is what I understand of it. tptacek, feel free to explain it better (just kidding!)