0

I'm looking for the difference between a "normal" traceroute (ICMP layer 3) and a TCP traceroute (Layer 4).

I sometimes see system engineers using tcptraceroute and the hops continue further than with a regular traceroute.
How does this work?

1

Any variant of works by sending out packages with a Time to life (TTL) of one for the first hop, the router will then decrement the TTL counter and will send an ICMP error message (Time Exceeded) back to the sender. Then it will generate a packet with a TTL of 2, the first router decrements the TTL counter and forwards it to the next router which will also decrement the counter and send an ICMP error message as the counter has reached 0. This goes on and on and on till the packet reaches it's destination or a hop limit (usually 30) is reached.

Normal *NIX traceroute use UDP, Windows tracert is using ICMP. These protocols are often filtered.

When using tcptraceroute to a sever and port that is offering this service (e.g. HTTP) you'll can't block these request because that would make it also impossible to access the service in a normal way, in case of HTTP accessing a website with a browser.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.