Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only when TTL=15 or higher. If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK or does it have to be more than 1. Please check the wireshark output.Traceroute Wireshark Capture
1 Answer
If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK?
No. the server (or any device) will decrement the TTL counter, then test if it is zero. If so, it will send a time-exceeded message. If it is not zero, the packet will be sent for processing at the higher layers in the protocol stack.
-
Thanks, Ron. But could someone clarify why it failed for TTL=2. Jun 6, 2016 at 3:08
-