Has anyone ever found a tool that performs a TCP traceroute with an actual established TCP session? I can launch a server/client on each end, if required. tcptraceroute & mtr aren't candidates here. (The docs for tcptraceroute state, "It is worth noting that tcptraceroute never completely establishes a TCP connection with the destination host.")

In my case, TCP traceroutes w/mtr are not showing any packet loss or congestion along the path, but actual sessions between iperf3 server & client do show congestion on the path between server & client on some sessions where the TCP packets are more substantial than simple SYN packets.

My theory is that a path in the middle is operating at the TCP layer and is load balanced. I'm guessing that individual TCP sessions are pinned to a single device during their lifetime. If I could use a tool that would establish a real connection and then incrementally change the TTL on the IP packet headers (without manipulating the TCP headers), I could determine if sessions really pinned somewhere in the middle and potentially which device in the middle is responsible for congestion issues.

  • I should note that when using iperf3, I'm running 10 sessions simultaneously and on average 2 out of the 10 sessions are significantly slower than the other 8 (<1mbps vs >30mbps). iperf3 server logs the congestion windows on each session and that shows that those sessions are suffering congestion on the path.
    – timehat
    May 18 '16 at 21:51
  • Product and resource recommendations are explicitly off-topic here, as they are on most SE sites.
    – Ron Maupin
    May 18 '16 at 21:55
  • 1
    @RonMaupin I see that questions regarding "tools used by network professionals" are on topic. What's the difference between that and product & resource recommendations?
    – timehat
    May 18 '16 at 22:06
  • Recommendations are off-topic, but help using the tools is not.
    – Ron Maupin
    May 18 '16 at 22:46
  • Regarding your problem, have you looked at the network diagrams to predict the expected path, and does that match what tcptraceroute gives you? What sort of devices may you have in your network that would cause this behavior? Do you have proxies or load balancers in between? Different packets in a single TCP session can take different routes, too.
    – Ron Maupin
    May 18 '16 at 23:27

It sounds like Scapy might be what you're looking for. Here's an example of how to change the TTL in a packet.

  • Thank you. I'm testing with hexinject right now, but Scrapy looks like the next thing I should try.
    – timehat
    May 19 '16 at 19:15
  • No worries at all @timehat
    – OzNetNerd
    May 20 '16 at 3:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.