0

Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only when TTL=15 or higher. If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK or does it have to be more than 1. Please check the wireshark output.Traceroute Wireshark Capture

|improve this question
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 14 '17 at 4:40
1

If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK?

No. the server (or any device) will decrement the TTL counter, then test if it is zero. If so, it will send a time-exceeded message. If it is not zero, the packet will be sent for processing at the higher layers in the protocol stack.

|improve this answer
  • Thanks, Ron. But could someone clarify why it failed for TTL=2. – Kaushal Deodhar Jun 6 '16 at 3:08
  • How do you know it's 13 hops? Define 'hop'. – Jaap Keuter Jun 6 '16 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.