Treck Network Stack Discovery Tool by JSOF
ICMP_MS_SYNC: Sending ICMP with type 165 (0xa5) to the target device results in an answer with ICMP type 166 (0xa6).
- HIGH RELIABILITY. This is a unique behavior. However, failure cannot be verified to mean it isn't a Treck device. We have not seen any false positives to date. This can be used as a standalone signature.