Jorge,
This could be for any number of reasons but most likely is because your host is
sending ICMP TTL expired messages back from a source address it does not own
(i.e. dtsn.darpa.mil [192.5.18.107]). Now if any kind of reverse path
filtering or if the Uruguayan ISP uses RFC 2827 than it may be possible that
they are dropping your fake hop generated packets at the borders.
Zack Payton
-----Original Message-----
From: Jorge Alfredo Garcia [mailto:frederix@gmail.com]
Sent: Friday, September 16, 2005 1:23 PM
To: pen-test@securityfocus.com
Subject: hopfake question.
im trying hopkake by xenion to do some testings about traceroute.
Im having some problem testing the code from different locations for example a
traceroute from my own country against an ip on my conutry works fine:
C:\>tracert 200.125.36.216
Traza a la dirección r200-125-36-216-dialup.adsl.anteldata.net.uy [200.125.36.21
6]
sobre un máximo de 30 saltos:
1 18 ms 19 ms 19 ms agu2bras1.antel.net.uy [200.40.0.67]
2 47 ms 50 ms 47 ms spider.ncts.navy.mil [138.147.50.5]
3 44 ms 49 ms 52 ms www.army.mil [140.183.234.10]
4 51 ms 49 ms 49 ms darpademo1.darpa.mil [192.5.18.104]
5 47 ms 49 ms 49 ms iso.darpa.mil [192.5.18.105]
6 43 ms 53 ms 49 ms ws18-106.darpa.mil [192.5.18.106]
7 47 ms 49 ms 49 ms dtsn.darpa.mil [192.5.18.107]
8 47 ms 49 ms 49 ms daml.darpa.mil [192.5.18.108]
9 47 ms 49 ms 49 ms border.hcn.hq.nasa.gov [198.116.142.1]
10 198.116.142.34 informes: Red de destino inaccesible.
Traza completa.
Those address are fake ones using the techinique of sending differents icmp
packets with the last one.
C:\>
But a tracert from spain to uruguay doesnt seeems to work properly:
[root@ns20303 dark]# traceroute 200.125.34.234 traceroute to 200.125.34.234
(200.125.34.234), 30 hops max, 38 byte packets
1 p19-11-m1.routers.ovh.net (213.251.133.253) 0.737 ms 0.717 ms 0.814 ms
2 p19-7-6k.routers.ovh.net (213.186.32.65) 0.379 ms 0.337 ms 0.486 ms
3 th2-1-6k.routers.ovh.net (213.186.32.4) 1.037 ms 0.622 ms 0.722 ms
4 th2-1-6k.routers.ovh.net (213.186.32.250) 0.764 ms 0.802 ms 0.701 ms
5 ge-0-0-0-4.r00.parsfr01.fr.bb.verio.net (81.25.193.166) 0.962 ms 0.940 ms
0.931 ms
6 p4-1-1-2.r21.londen03.uk.bb.verio.net (129.250.2.87) 8.015 ms
8.044 ms 8.036 ms
7 p16-0-0-0.r80.nycmny01.us.bb.verio.net (129.250.5.91) 81.659 ms 81.680 ms
81.899 ms
8 p16-0-1-3.r21.nycmny01.us.bb.verio.net (129.250.2.170) 81.689 ms
81.785 ms 81.878 ms
9 p16-7-0-0.r04.nycmny01.us.bb.verio.net (129.250.3.49) 81.474 ms
81.417 ms 81.443 ms
10 p4-0.uunet.nycmny01.us.bb.verio.net (129.250.9.166) 81.791 ms
81.727 ms 81.665 ms
11 0.so-6-0-0.XL1.NYC9.ALTER.NET (152.63.18.226) 81.826 ms 81.692 ms 81.726
ms
12 0.so-7-0-0.XL1.MIA4.ALTER.NET (152.63.86.189) 113.491 ms 113.294 ms
113.147 ms
13 POS6-0.GW4.MIA4.ALTER.NET (152.63.82.141) 113.110 ms 112.967 ms
113.067 ms
14 antel-gw.customer.alter.net (157.130.83.138) 257.014 ms 257.841 ms
257.590 ms
15 icoreagu1-backb.antel.net.uy (200.40.0.15) 256.189 ms 256.480 ms
256.288 ms
16 gaguada-h-adinet.antel.net.uy (200.40.0.135) 262.947 ms 260.733 ms
261.747 ms
17 agu2bras1-acc.antel.net.uy (200.40.18.65) 258.974 ms 259.006 ms
262.406 ms
18 * * *
19 * * *
20 * * *
21 * * *
22 r200-125-34-234-dialup.adsl.anteldata.net.uy (200.125.34.234)
283.199 ms 290.822 ms 288.108 ms
[root@ns20303 dark]#
As you can see the fake hops not appear in the attackers host.
I tested a lot and in the majority of the case its seems it doesnt works.
Please, i want to know why this problem and if it is there a posibility to fix
it.
Thanx in advance.
jorge.
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
