Can someone enlighten me on how the below is possible?

I have a remote site, L2 connection to HQ. Clients are configured like this...

  • Client (rc01) IP address
  • Gateway (The catch: I have no access or control of this device)

HQ Edge firewall details...

  • internal
  • external

HQ example server...let's call it hq01

  • Gateway

When I run a tracert from rc01 -> hq01 the first response is from hq01. But if I do the reverse (hq01 -> rc01) the first response is from the internal interface of the hq firewall as expected.

How is rc01 finding hq01 without first going through a gateway?

  • 2
    because your gateway is a firewall, and it isn't messing with TTL. (firewalls are known to do this crap to "hide")
    – Ricky
    Jul 7 '15 at 3:59

Firewalls can be setup to not decrement the ttl(time to live) as a weak security feature, to make them invisible. This is the default on the ASA.

Explanation for your scenario,

The FW( has a interface in the server range Then traceroute with ttl=1 will hit hq01 and get a response as FW delivers packet to directly connected subnet without decrementing the ttl.

In the reverse direction your server hq01 uses a real router, and sees it as the first hop, the FW is again hidden (no ttl decrement) and you see the pc next.

Traceroute Overview

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.