0

Facing a weird problem in a production environment where the traceroute is only showing the final hop and output looks like below,

***
***
***
***
***
***
dns.google [8.8.8.8] 10/10/11ms

It is the same case with any destination. Tried both Linux and Windows traceroute.

There is a firewall which a selective people have access to but I am not sure how can traceroute be restricted to only show last hop of any destination.

Any advice is appreciated

Thanks

1
  • They appear to be filtering responses, usually host/route/port ICMP no route , this is more common than you would think. There are 2 possibilities to try, force udp or tcp to port 53 and see what the response is. Even these will probably fail if the network guys know their stuff.
    – Bib
    Commented Aug 18, 2022 at 20:33

1 Answer 1

0

Traceroute work by using ICMP and the field "TTL" (Time to live).

It start by setting TTL field to "1", then the first router decrement this field when it receive the packet. Since the field is "0", it does not route the packet to its destination. Instead, send an answer to the source system to inform it that the packet TTL is expired.

Traceroute get this answer to know the first router ip address ...

Then traceroute send a new packet with the field TTL to "2" to find the second router ip address.

The answer sent by the routers when the TTL reach 0 is an ICMP packet, and more precisely an "ICMP expired packet"

A firewall can be configured to block specific type of ICMP packet. In your case, the admin probably block "ICMP TTL expired packet".

However you can see the last hop (the destination). It's probably means that normal ICMP answer send by the final target (when TTL is not expired) are not blocked on the firewall

You can find the different kind of ICMP packet on the wikipedia page : https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

1
  • See also shouldiblockicmp.com . A lot of times only echo reply is enabled, but time exceeded is also required for traceroute.
    – melds
    Commented Aug 19, 2022 at 1:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .