-
Notifications
You must be signed in to change notification settings - Fork 24
/
Copy pathtcptraceroute.1.html
321 lines (230 loc) · 7.18 KB
/
tcptraceroute.1.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE>Man page of TCPTRACEROUTE</TITLE>
</HEAD><BODY>
<A NAME="lbAB"> </A>
<H2>NAME</H2>
tcptraceroute - A traceroute implementation using TCP packets
<A NAME="lbAC"> </A>
<H2>SYNOPSIS</H2>
<B>tcptraceroute [-nNFSAE] [ -i</B>
<I>interface</I>
<B>] [ -f</B>
<I>first ttl </I>
<B>]</B>
<BR>
<B>[ -l</B>
<I>length</I>
<B>] [ -q</B>
<I>number of queries</I>
<B>] [ -t</B>
<I>tos</I>
<B>]</B>
<BR>
<B>[ -m</B>
<I>max ttl</I>
<B>] [ -p</B>
<I>source port</I>
<B>] [ -s</B>
<I>source address</I>
<B>]</B>
<BR>
<B>[ -w</B>
<I>wait time</I>
<B>]</B>
<I>host</I>
<B>[</B>
<I>destination port</I>
<B>]</B>
<B>[</B>
<I>length</I>
<B>]</B>
<A NAME="lbAD"> </A>
<H2>DESCRIPTION</H2>
<B>tcptraceroute</B>
is a traceroute implementation using TCP packets.
The more traditional
<I>traceroute</I>(8)
sends out either UDP or ICMP ECHO packets with a TTL of one, and increments
the TTL until the destination has been reached. By printing the gateways that
generate ICMP time exceeded messages along the way, it is able to determine the
path packets are taking to reach the destination.
<p>
The problem is that with the widespread use of firewalls on the modern
Internet, many of the packets that
<I>traceroute</I>(8)
sends out end up being filtered, making it impossible to completely trace the
path to the destination. However, in many cases, these firewalls will permit
inbound TCP packets to specific ports that hosts sitting behind the
firewall are listening for connections on. By sending out TCP SYN packets
instead of UDP or ICMP ECHO packets,
<B>tcptraceroute</B>
is able to bypass the most common firewall filters.
<p>
It is worth noting that
<B>tcptraceroute</B>
never completely establishes a TCP connection with the destination host.
If the host is not listening for incoming connections, it will respond with
an RST indicating that the port is closed. If the host instead responds
with a SYN|ACK, the port is known to be open, and an RST is sent by the
kernel
<B>tcptraceroute</B>
is running on to tear down the connection without completing
three-way handshake. This is the same half-open scanning technique
that
<I>nmap</I>(1)
uses when passed the
<B>-sS</B>
flag.
<A NAME="lbAE"> </A>
<H2>OPTIONS</H2>
<B><DL COMPACT>
<DT>-n<DD>
</B>
Display numeric output, rather than doing a reverse DNS lookup for each hop.
By default, reverse lookups are never attempted on RFC1918 address space,
regardless of the -n flag.
<B><DT>-N<DD>
</B>
Perform a reverse DNS lookup for each hop, including RFC1918 addresses.
<B><DT>-f<DD>
</B>
Set the initial TTL used in the first outgoing packet. The default is 1.
<B><DT>-m<DD>
</B>
Set the maximum TTL used in outgoing packets. The default is 30.
<B><DT>-p<DD>
</B>
Use the specified local TCP port in outgoing packets. The default is to
obtain a free port from the kernel using
<I>>bind</I>(2).
Unlike with traditional
<I>traceroute</I>(8),
this number will not increase with each hop.
<B><DT>-s<DD>
</B>
Set the source address for outgoing packets. See also the -i flag.
<B><DT>-i<DD>
</B>
Use the specified interface for outgoing packets.
<B><DT>-q<DD>
</B>
Set the number of probes to be sent to each hop. The default is 3.
<B><DT>-w<DD>
</B>
Set the timeout, in seconds, to wait for a response for each probe. The
default is 3.
<B><DT>-S<DD>
</B>
Set the TCP SYN flag in outgoing packets. This is the default, if neither
-S or -A is specified.
<B><DT>-A<DD>
</B>
Set the TCP ACK flag in outgoing packets. By doing so, it is possible to
trace through stateless firewalls which permit outgoing TCP connections.
<B><DT>-E<DD>
</B>
Send ECN SYN packets, as described in RFC2481.
<B><DT>-t<DD>
</B>
Set the IP TOS (type of service) to be used in outgoing packets. The
default is not to set any TOS.
<B><DT>-F<DD>
</B>
Set the IP "don't fragment" bit in outgoing packets.
<B><DT>-l<DD>
</B>
Set the total packet length to be used in outgoing packets. If the length
is greater than the minimum size required to assemble the necessary probe
packet headers, this value is automatically increased.
<B><DT>-d<DD>
</B>
Enable debugging, which may or may not be useful.
<p>
<B><DT>--dnat<DD>
</B>
<BR>
Enable DNAT detection, and display messages when DNAT transitions are
observed. DNAT detection is based on the fact that some NAT devices,
such as some Linux 2.4 kernels, do not correctly rewrite the IP address
of the IP packets quoted in ICMP time-exceeded messages
tcptraceroute solicits, revealing the destination IP address an outbound
probe packet was NATed to. NAT devices which correctly rewrite the IP
address quoted by ICMP messages, such as some Linux 2.6 kernels, will
not be detected. For some target hosts, it may be necessary to use
--dnat in conjunction with --track-port. See the examples.txt file for
examples.
<p>
<B><DT>--no-dnat<DD></B>
<BR>
Enable DNAT detection for the purposes of correctly identifying ICMP
time-exceeded messages that match up with outbound probe packets, but
do not display messages when a DNAT transition is observed. This is
the default behavior.
<p>
<B><DT>--no-dnat-strict<DD></B>
<BR>
Do not perform any DNAT detection whatsoever. No attempt will be made
match up ICMP time-exceeded messages with outbound probe packets, and
when tracerouting through a NAT device which does not rewrite the IP
addresses of the IP packets quoted in ICMP time-exceeded messages, some
hops along the path may appear to be unresponsive. This option should
not be needed in the vast majority of cases, but may be utilized if
it is suspected that the DNAT detection code is misidentifying ICMP
time-exceeded messages.
<p>
</DL>
<A NAME="lbAF"> </A>
<H2>EXAMPLES</H2>
Please see the
<I>examples.txt</I>
file included in the
<B>tcptraceroute</B>
distribution for a few real world examples.
To trace the path to a web server listening for connections on port 80:
<DL COMPACT><DT><DD>
<B>tcptraceroute webserver</B>
</DL>
To trace the path to a mail server listening for connections on port 25:
<DL COMPACT><DT><DD>
<B>tcptraceroute mailserver 25</B>
</DL>
<A NAME="lbAG"> </A>
<H2>BUGS</H2>
No error checking is performed on the source address specified by the -s
flag, and it is therefore possible for
<B>tcptraceroute</B>
to send out TCP SYN packets for which it has no chance of seeing a response
to.
<A NAME="lbAH"> </A>
<H2>AUTHOR</H2>
Michael C. Toren <<A HREF="mailto:mct@toren.net">mct@toren.net</A>>
<A NAME="lbAI"> </A>
<H2>AVAILABILITY</H2>
For updates, please see:
<BR>
<DL COMPACT><DT><DD>
<A HREF="http://michael.toren.net/code/tcptraceroute/">http://michael.toren.net/code/tcptraceroute/</A>
</DL>
<A NAME="lbAJ"> </A>
<H2>SEE ALSO</H2>
<I>traceroute</I>(8),
<I>ping</I>(8),
<I>nmap</I>(1)
<P>
<HR>
<A NAME="index"> </A><H2>Index</H2>
<DL>
<DT><A HREF="#lbAB">NAME</A><DD>
<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
<DT><A HREF="#lbAE">OPTIONS</A><DD>
<DT><A HREF="#lbAF">EXAMPLES</A><DD>
<DT><A HREF="#lbAG">BUGS</A><DD>
<DT><A HREF="#lbAH">AUTHOR</A><DD>
<DT><A HREF="#lbAI">AVAILABILITY</A><DD>
<DT><A HREF="#lbAJ">SEE ALSO</A><DD>
</DL>
<HR>
This document was created by man2html.
</BODY>
</HTML>