0

Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only when TTL=15 or higher. If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK or does it have to be more than 1. Please check the wireshark output.Traceroute Wireshark Capture

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 21, 2020 at 17:47

1 Answer 1

Reset to default
1

If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK?

No. the server (or any device) will decrement the TTL counter, then test if it is zero. If so, it will send a time-exceeded message. If it is not zero, the packet will be sent for processing at the higher layers in the protocol stack.

Improve this answer
2
  • Thanks, Ron. But could someone clarify why it failed for TTL=2.
    – Kaushal Deodhar
    Jun 6, 2016 at 3:08
  • How do you know it's 13 hops? Define 'hop'.
    – Jaap Keuter
    Jun 6, 2016 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.