Discriminating malcious packets using TTL in the IP header