Security Basics mailing list archives

Re: traceroute-like tool for UDP or TCP packets


From: shawnmer <shawnmer () io com>
Date: Thu, 21 Aug 2003 17:26:26 -0500 (CDT)

Hi,

Have a look at tcptraceroute <http://michael.toren.net/code/tcptraceroute>.

<snip>

Description

tcptraceroute is a traceroute implementation using TCP packets.

The more traditional traceroute(8) sends out either UDP or ICMP ECHO 
packets with a TTL of one, and increments the TTL until the destination 
has been reached. By printing the gateways that generate ICMP time 
exceeded messages along the way, it is able to determine the path packets 
are taking to reach the destination.

The problem is that with the widespread use of firewalls on the modern 
Internet, many of the packets that traceroute(8) sends out end up being 
filtered, making it impossible to completely trace the path to the 
destination. However, in many cases, these firewalls will permit inbound 
TCP packets to specific ports that hosts sitting behind the firewall are 
listening for connections on. By sending out TCP SYN packets instead of 
UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common 
firewall filters. 

</snip>

Thanks,

-scm



KJ:Kent James

KJ>One of the local ISPs is having trouble getting DNS information from
KJ>Easydns. I suspect they have a misconfigured firewall or other security
KJ>block in their system. I can ping and traceroute the DNS servers but get no
KJ>response from UDP or TCP packets.
KJ>
KJ>Is there a tool that works like traceroute, only shows the route for TCP or
KJ>UDP packets instead of the ICMP packets that traceroute uses?
KJ>
KJ>+----------------+
KJ>  Kent James, Ph.D, MCSE
KJ>  Computer network support in Baku, Azerbaijan
KJ>+----------------+
KJ>
KJ>
KJ>---------------------------------------------------------------------------
KJ>----------------------------------------------------------------------------
KJ>


---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: