1

I am doing a traceroute to salesforce.com, google.com and I see all the layer hops to my Firewall and then one hop to final destination- which is incorrect. I am not seeing any of the intermediate public hops (and surprisingly not seeing the

Do you know why is this the case? Is this a Firewall config issue?

[root@XXX]# traceroute -T -p 80 www.salesforce.com
traceroute to www.salesforce.com (96.43.148.26), 30 hops max, 60 byte packets
1  10.100.151.252  0.846 ms  
2  10.100.1.158   0.435 ms 
3  10.100.1.46   0.314 ms  
4  10.200.250.9  6.132 ms
5  10.201.1.53 6.363 ms
6  www-was-1.salesforce.com (96.43.148.26)

The Firewall was configured as a transparent Proxy. Hence all TCP /80 & 443 connections were terminated on the Firewall and the firewall sending back proxy response.

Improve this question
1
  • 1
    Traceroute is a useful tool on your own network where you know what to expect, but it can be very misleading on the public Internet where it is passing through multiple ISPs, some of which may be looking for traceroute traffic and doing things, e.g. rerouting traceroute packets, to prevent you from casually discovering the ISP network structure.
    – Ron Maupin ♦
    Jul 16, 2017 at 16:40

2 Answers 2

Reset to default
2

How do you know this is incorrect? They might have direct peering or there's a tunnel in that last hop. Alternatively, the NAT router is resetting the TTL, so tracert is no use.

Improve this answer
2
  • I have checked this with my ISP and they have confirmed that traceroute is incorrect. They did a traceroute from their router as well. Ping is giving me a 89 ms Latency, as opposed to 6 ms
    – nnay84
    Jul 16, 2017 at 16:07
  • @nnay84 Once again because the wild internet goes thought lots of changes and lots of hosts. The address you are pinging may not be the same endpoint host every time. All of Google's servers and services operate on a farm. Pinging google is a good way to check if a viable route exists, but ping can't tell you the route, and traceroute is easy to muck with using any of numerous intermediary devices one of which your ISP is obviously using.
    – Rowan Hawkins
    Jul 18, 2017 at 21:54
2

In this case the firewall was also configured as a transparent Proxy. The proxy was intercepting all TCP connections and sending a response as the final destination.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.