A supplement to the traceroute command found in Linux distributions is the tcptraceroute tool. The normal traceroute command sends either a UDP or ICMP echo request packet to the target house with a Time to Live (TTL) set to one. This TTL is increased by one for each host it reaches until the packet reaches the target host. The major difference between traceroute and the tcptraceroute tool is that the tcptraceroute tool uses a TCP SYN packet to the target host.
The main advantage with using tcptraceroute is when you have the possibility of encountering a firewall between the testing machine and the target. Firewalls are often configured to filter out ICMP and UDP traffic associated with the traceroute command. As a result, the traceroute information will not be useful to you. Using tcptraceroute gives the ability to use the TCP connection on a specific port, which the firewall will allow you to pass through, thereby allowing you to enumerate the network routing path through the firewall.
The tcptraceroute command makes use of the TCP three-way handshake to determine whether the patch through the firewall is allowed. If the port is open, you will receive a SYN/ACK packet. If the port is closed, you will receive an RST packet. To start tcptraceroute, type the following into the command line:
# tcptraceroute
This command will show the different functions related to the command.
The simplest usage is running the command against a domain. For this demonstration, we will run the traceroute command to trace the network route to the domain the example.com:
# traceroute www.example.com
The redacted output for traceroute is as follows:
traceroute to www.example.com (192.168.10.100), 30 hops max, 40 byte packets
1 192.168.1.1 (192.168.1.1) 8.382 ms 12.681 ms 24.169 ms
2 1.static.192.168.xx.xx.isp (192.168.2.1) 47.276 ms 61.215 ms 61.057 ms
3 * * *
4 74.subnet192.168.xx.xx.isp (192.168.4.1) 68.794 ms 76.895 ms 94.154 ms
5 isp2 (192.168.5.1) 122.919 ms 124.968 ms 132.380 ms
...
15 * * *
...
30 * * *
As you can see, there are several steps that are indicated and others that appear as ***. If we look at the output, by hop 15, we see that there is no information available. This is indicative of a filtering device between the tester machine and the host, example.com domain.
To counter this filtering, we will try to determine the route using the tcptraceroute command. As we know that example.com has a web server, we will set the command to try the TCP port 80, which is the HTTP port. Here is the command:
# tcptraceroute www.example.com
The output is as follows:
Selected device eth0, address 192.168.1.107, port 41884 for outgoing packets
Tracing the path to www.example.com (192.168.10.100) on TCP port 80 (www), 30 hops max
1 192.168.1.1 55.332 ms 6.087 ms 3.256 ms
2 1.static.192.168.xx.xx.isp (192.168.2.1) 66.497 ms 50.436 ms 85.326 ms
3 * * *
4 74.subnet192.168.xx.xx.isp (192.168.4.1) 56.252 ms 28.041 ms 34.607 ms
5 isp2 (192.168.5.1) 51.160 ms 54.382 ms 150.168 ms
6 192.168.6.1 106.216 ms 105.319 ms 130.462 ms
7 192.168.7.1 140.752 ms 254.555 ms 106.610 ms
...
14 192.168.14.1 453.829 ms 404.907 ms 420.745 ms
15 192.168.15.1 615.886 ms 474.649 ms 432.609 ms
16 192.168.16.1 [open] 521.673 ms 474.778 ms 820.607 ms
As we can see from the tcptraceroute output, the request has reached our target system and has given us the hops that the request took to get to the target.