I'm looking for the difference between a "normal" traceroute (ICMP layer 3) and a TCP traceroute (Layer 4).
I sometimes see system engineers using tcptraceroute and the hops continue further than with a regular traceroute.
How does this work?
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Commented Dec 17, 2020 at 16:30
Add a comment
|
1 Answer
Any variant of works by sending out packages with a Time to life (TTL) of one for the first hop, the router will then decrement the TTL counter and will send an ICMP error message (Time Exceeded) back to the sender. Then it will generate a packet with a TTL of 2, the first router decrements the TTL counter and forwards it to the next router which will also decrement the counter and send an ICMP error message as the counter has reached 0. This goes on and on and on till the packet reaches it's destination or a hop limit (usually 30) is reached.
Normal *NIX traceroute use UDP, Windows tracert is using ICMP. These protocols are often filtered.
When using tcptraceroute to a sever and port that is offering this service (e.g. HTTP) you'll can't block these request because that would make it also impossible to access the service in a normal way, in case of HTTP accessing a website with a browser.