On Tuesday, October 26, 2004 9:54 AM, Renaud Deraison wrote > > Run tcpdump while the tcptraceroute is going on : > > # tcpdump -ln 'icmp and ( icmp[0] = 3 or icmp[0] = 11)' > > You'll see the time exceeded in transit error messages popping up. >
I did just this on our internal network and compared the results of a regular traceroute and tcptraceroute. My system is three hops away from the target. traceroute generated: 12:01:04.435254 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:04.464384 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:04.467502 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:04.470206 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:04.474800 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:04.477442 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:04.479522 IP 10.X.Z.2 > 10.X.W.19: icmp 36: 10.226.15.2 udp port 33441 unreachable 12:01:04.484193 IP 10.X.Z.2 > 10.X.W.19: icmp 36: 10.226.15.2 udp port 33442 unreachable 12:01:04.487784 IP 10.X.Z.2 > 10.X.W.19: icmp 36: 10.226.15.2 udp port 33443 unreachable while tcptraceroute generated: 12:01:16.581593 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:16.585319 IP 10.X.W.253 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:16.594272 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:16.597930 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded in-transit 12:01:16.603119 IP 10.X.Y.251 > 10.X.W.19: icmp 36: time exceeded in-transit So tcptraceroute does use ICMP messages. It did generate fewer packets that match the filter, so maybe it does it more efficiciently, but it does use them. -Jason PS - I apologize in advance for the legal disclaimer at the bottom of my email message. This is tacked on by our SMTP gateway and I have no control over it. -- ------------------------------------------------------------------------------ Confidentiality notice: This e-mail message, including any attachments, may contain legally privileged and/or confidential information. If you are not the intended recipient(s), or the employee or agent responsible for delivery of this message to the intended recipient(s), you are hereby notified that any dissemination, distribution, or copying of this e-mail message is strictly prohibited. If you have received this message in error, please immediately notify the sender and delete this e-mail message from your computer. ============================================================================== _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
