Did you know you could traceroute over the TCP protocol?
The regular traceroute usually uses either ICMP or UDP protocols. Unfortunately, firewalls and routers often block the ICMP protocol completely or disallow the ICMP echo requests (ping requests), and/or block various UDP ports. However, you'd rarely have firewalls and routers drop TCP protocol on port 80 because it's the web port.
Check this out.
Let's try to traceroute www.microsoft.com using ICMP protocol:
# traceroute -I www.microsoft.com traceroute to www.microsoft.com (65.55.57.27), 30 hops max, 60 byte packets 1 50.57.125.2 (50.57.125.2) 0.552 ms 0.647 ms 0.742 ms 2 core1-aggr701a-3.ord1.rackspace.net (184.106.126.50) 0.415 ms 0.555 ms 0.653 ms 3 corea.ord1.rackspace.net (184.106.126.128) 0.707 ms 0.873 ms 0.984 ms 4 bbr1.ord1.rackspace.net (184.106.126.147) 1.345 ms 1.341 ms 1.337 ms 5 * * * 6 204.152.140.33 (204.152.140.33) 3.614 ms 3.747 ms 3.244 ms 7 xe-0-2-0-0.ch1-96c-2b.ntwk.msn.net (207.46.46.49) 3.319 ms 4.019 ms 4.010 ms 8 ge-7-0-0-0.co1-64c-1a.ntwk.msn.net (207.46.40.94) 53.543 ms 53.105 ms 53.074 ms 9 xe-5-2-0-0.co1-96c-1b.ntwk.msn.net (207.46.40.165) 52.942 ms 52.710 ms 52.670 ms 10 * * * 11 * * * 12 * * * 13 * * *
We get lots of * and we've no idea how the packets reach www.microsoft.com.
Now let's try UDP traceroute:
# traceroute -U www.microsoft.com traceroute to www.microsoft.com (65.55.57.27), 30 hops max, 60 byte packets 1 50.57.125.2 (50.57.125.2) 0.529 ms 0.599 ms 0.662 ms 2 core1-aggr701a-3.ord1.rackspace.net (184.106.126.50) 0.480 ms 0.571 ms 0.658 ms 3 corea.ord1.rackspace.net (184.106.126.128) 0.507 ms corea.ord1.rackspace.net (184.106.126.124) 0.463 ms 0.569 ms 4 bbr1.ord1.rackspace.net (184.106.126.145) 1.345 ms 1.322 ms 1.290 ms 5 * * * 6 * 204.152.140.35 (204.152.140.35) 2.697 ms * 7 xe-0-2-0-0.ch1-96c-2b.ntwk.msn.net (207.46.46.49) 3.665 ms ge-7-0-0-0.co1-64c-1a.ntwk.msn.net (207.46.40.94) 53.363 ms 52.597 ms 8 xe-3-1-0-0.co1-96c-1b.ntwk.msn.net (207.46.33.190) 52.284 ms 52.643 ms xe-0-1-0-0.co1-96c-1a.ntwk.msn.net (207.46.33.177) 52.665 ms 9 * * * 10 * * * 11 * * * 12 * * * 13 * * *
Same shit.
But now let's try traceroute over the TCP protocol, port 80:
# traceroute -T -p 80 www.microsoft.com traceroute to www.microsoft.com (65.55.57.27), 30 hops max, 60 byte packets 1 50.57.125.2 (50.57.125.2) 0.540 ms 0.629 ms 0.709 ms 2 core1-aggr701a-3.ord1.rackspace.net (184.106.126.50) 0.486 ms 0.604 ms 0.691 ms 3 corea.ord1.rackspace.net (184.106.126.128) 0.511 ms corea.ord1.rackspace.net (184.106.126.124) 0.564 ms 0.810 ms 4 bbr1.ord1.rackspace.net (184.106.126.147) 1.339 ms 1.310 ms bbr1.ord1.rackspace.net (184.106.126.145) 1.307 ms 5 chi-8075.msn.net (206.223.119.27) 3.619 ms 2.560 ms 2.528 ms 6 * 204.152.140.35 (204.152.140.35) 3.640 ms * 7 ge-7-0-0-0.co1-64c-1a.ntwk.msn.net (207.46.40.94) 52.523 ms xe-0-2-0-0.ch1-96c-2b.ntwk.msn.net (207.46.46.49) 3.825 ms xe-1-2-0-0.ch1-96c-2b.ntwk.msn.net (207.46.46.53) 3.355 ms 8 xe-0-1-0-0.co1-96c-1a.ntwk.msn.net (207.46.33.177) 61.042 ms 61.032 ms 60.457 ms 9 * * xe-5-2-0-0.co1-96c-1b.ntwk.msn.net (207.46.40.165) 100.069 ms 10 65.55.57.27 (65.55.57.27) 53.868 ms 53.038 ms 52.097 ms
A full network path to www.microsoft.com!
There are various different traceroute implementations and if your system doesn't have one that supports tcp protocol, I you can get the new modern implementation of traceroute or get the tcptraceroute by Michael Toren.
See you next time!