On Tuesday, October 26, 2004 9:54 AM, Renaud Deraison wrote
Run tcpdump while the tcptraceroute is going on :
# tcpdump -ln 'icmp and ( icmp[0] = 3 or icmp[0] = 11)'
You'll see the time exceeded in transit error messages popping up.
I did just this on our internal network and compared the results of a
regular traceroute and tcptraceroute.
My system is three hops away from the target.
traceroute generated:
12:01:04.435254 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:04.464384 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:04.467502 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:04.470206 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:04.474800 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:04.477442 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:04.479522 IP 10.X.Z.2 > 10.X.W.19: icmp 36: 10.226.15.2 udp port
33441 unreachable
12:01:04.484193 IP 10.X.Z.2 > 10.X.W.19: icmp 36: 10.226.15.2 udp port
33442 unreachable
12:01:04.487784 IP 10.X.Z.2 > 10.X.W.19: icmp 36: 10.226.15.2 udp port
33443 unreachable
while tcptraceroute generated:
12:01:16.581593 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:16.585319 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:16.594272 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:16.597930 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded
in-transit
12:01:16.603119 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded
in-transit
So tcptraceroute does use ICMP messages. It did generate fewer packets
that match the filter, so maybe it does it more efficiciently, but it
does use them.
-Jason
PS - I apologize in advance for the legal disclaimer at the bottom of my
email message. This is tacked on by our SMTP gateway and I have no
control over it.
--
------------------------------------------------------------------------------
Confidentiality notice:
This e-mail message, including any attachments, may contain legally privileged
and/or confidential
information. If you are not the intended recipient(s), or the employee or agent
responsible for delivery
of this message to the intended recipient(s), you are hereby notified that any
dissemination,
distribution, or copying of this e-mail message is strictly prohibited. If you
have received this message
in error, please immediately notify the sender and delete this e-mail message
from your computer.
==============================================================================
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
