Re: tcptraceroute outcome

From: thomas springer (tuevsec@gmx.net)
Date: Sun Sep 17 2006 - 04:57:39 EDT


you just hit a loadbalanced site (if your route ends at hop10) or a
loadbalanced router (if the trace continues after hop10) - this is a
quite common setup.
you might also htry tcptraceroute with the --dnat-option
(http://www.serversniff.net's tcptrace-script does this by default) or
more tries per hop - depending on hop10's setup this might tell you more
about dual-homed or natted systems.

thomas

Christian Perst wrote:
> Hi list members,
>
> with tcptraceroute I get
> ...
> 7 213.225.aaa.aaa (213.225.aaa.aaa) 24.396 ms 25.027 ms 25.306 ms
> 8 213.225.bbb.bbb (213.225.bbb.bbb) 29.464 ms 29.012 ms 29.285 ms
> 9 213.225.ccc.ccc (213.225.ccc.ccc) 29.967 ms 30.912 ms 29.656 ms
> 10 193.41.ddd.ddd (193.41.ddd.ddd) [closed] 30.694 ms
> 213.225.ccc.ccc (213.225.ccc.ccc) 30.265 ms
> 193.41.ddd.ddd (193.41.ddd.ddd) 30.501 ms
>
> That seems strange. Could that be a Router with 2 IPs 213.225.ccc.ccc
> on one interface and 193.41.ddd.ddd on the other interface?
>
> Why does ccc send "time exceeded" after the package has reached ddd?
>
> Thank,
> Chris
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ------------------------------------------------------------------------
>
>
>

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------



This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:58 EDT