This threshold protects against mistakenly filtering legitimate packets,
but it also makes HCF ineffective against low amounts of spoofing packets that
do not reach the threshold. Furthermore, because the range of expected hopcounts
on the Internet is narrow, around 10% of the spoofing packets can be
expected to have the correct hop-count [Jin et al. 2003].
An earlier paper [Templeton and Levitt 2003] also covered many of these
active and passive host-based methods, and they have remained largely unchanged.
For more detailed descriptions we refer readers to Templeton and
Levitt [2003].