> Maybe I'm just stupid today, but isn't traceroute just a series of ICMP
> packets
> with a specific Time-To-Live set in stages?
Actually, there are two main flavors of traceroute:
1. UNIX (Van Jacobson's): high-numbered UDP ports incoming (usually UDP ports
33434 + 3*TTL), ICMP_TIMXCEED or ICMP_UNREACH_PORT outgoing
2. Windows: ICMP_ECHO incoming, ICMP_TIMXCEED or ICMP_ECHOREPLY outgoing
Any IP protocol could be used. Incidentally, we have developed a TCP variant
which works very well.
> And if ICMP packets are allowed,
> how do you block the "traceroute" program?
You can't.
-JCT-
References:
|
|
