Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only when TTL=15 or higher. If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK or does it have to be more than 1. Please check the wireshark output.Traceroute Wireshark Capture
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin♦ Dec 21 '20 at 17:47
If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK?
No. the server (or any device) will decrement the TTL counter, then test if it is zero. If so, it will send a time-exceeded message. If it is not zero, the packet will be sent for processing at the higher layers in the protocol stack.