From: Alex Lambert (alambertquickfire.org)
Date: Wed Oct 22 2003 - 20:29:29 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Lucas Reddinger wrote:
> "Jeffrey Messec" <quadmonkduddleys.com> wrote:
>>My ISP blocks traceroute now as well. They started that after the
>>Blaster nonsense.
> How?! I thought it was accomplished merely by incrementing TTL from 1
> to completion. How can they detect this?

By default, in OpenBSD, traceroute sends UDP packets with low TTLs.
Perhaps your ISP is mangling this.

Try using the option "-P ICMP" -- that might work better.

man traceroute(8) says:
> -P proto
> Change the protocol being used from UDP to a numeric protocol or
> a name as specified in /etc/protocols. This will not work reli-
> ably for most protocols. If set to 1 (ICMP), then ICMP Echo Re-
> quest messages will be used (same as ping(8)).

See also the footnote:

> HISTORY
> The very first traceroute (never released) used ICMP ECHO_REQUEST data-
> grams as probe packets. During the first night of testing it was discov-
> ered that more than half the router vendors of the time would not return
> an ICMP TIME_EXCEEDED for an ECHO_REQUEST. traceroute was then changed
> to use UDP probe packets. Most modern TCP/IP implementations will now
> generate an ICMP error message to ICMP query messages, and the option to
> use ECHO_REQUEST probes was re-implemented.

apl

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]