From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ob0-f174.google.com (mail-ob0-f174.google.com [209.85.214.174]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 3918821F0A2 for ; Mon, 4 Feb 2013 06:17:11 -0800 (PST) Received: by mail-ob0-f174.google.com with SMTP id 16so6332775obc.19 for ; Mon, 04 Feb 2013 06:17:10 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:x-originating-ip:in-reply-to:references :date:message-id:subject:from:to:cc:content-type:x-gm-message-state; bh=VsrdlkwJUS17gXLFRlShV9BXlfimlCqayh5P3IRUB6c=; b=Hzf4IcCfPfGnAu25yy6gO9iKvailHcI4+8OM819pwbQmKKv2R48QWrVKqDDu78b/Be 5JggcFNMh4R5CV0e5ff6G5HD+9mdsJGJtEWIUC6IW14Q0xvgrP1Ty1Y8x19pW+jMT7Z1 2nym2V4NVcRpJitW73JN6o3mthbckDNKpbMg+vDUCJdCAgEwfz8ZLlxxiQaAyVrfEw7Y ivwlNLHeCp4yYx/smL/gv4K6yluM1i7SYYXYqgXhrxsgJGBJjokOVm+uBkzgb7JtuG2S PoM8wnbxBWNE7snh/DCn24f4ciG/WmDXDTAv/YFGD/b3B3TbU73QcEOPsGTDKUfEaVLG dMYA== MIME-Version: 1.0 X-Received: by 10.60.169.212 with SMTP id ag20mr4843246oec.102.1359987430043; Mon, 04 Feb 2013 06:17:10 -0800 (PST) Received: by 10.76.80.99 with HTTP; Mon, 4 Feb 2013 06:17:09 -0800 (PST) X-Originating-IP: [198.28.69.5] In-Reply-To: References: Date: Mon, 4 Feb 2013 15:17:09 +0100 Message-ID: From: Maciej Soltysiak To: Dave Taht Content-Type: multipart/alternative; boundary=bcaec5523a56aab16804d4e6bf47 X-Gm-Message-State: ALoCoQn+wV9zjp1cP3/1vFSvyerEC2fzMYJRXj0M1CXfp1vKGBxs7uHw0tXZrJ3pX+G8XkovkgTA Cc: cerowrt-devel@lists.bufferbloat.net Subject: Re: [Cerowrt-devel] ping icmp ttl exceeded X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Feb 2013 14:17:11 -0000 --bcaec5523a56aab16804d4e6bf47 Content-Type: text/plain; charset=UTF-8 On Mon, Feb 4, 2013 at 8:41 AM, Dave Taht wrote: > Heh. I turned out I'd left mtr running in another window... Yeah, exactly. Decreasing TTLs suggest traceroute tools :-) As Ketan noted, it's best to decode what's in the ICMP TTL exceeded payload to see what packet triggered this. traceroute uses ICMP ECHO REQUEST tracepath uses UDP tcptraceroute uses TCP SYN (this tools is actually usefull to check if your packets go different routes depending on the port they're going to, e.g. detecting a transparent proxy which shows up for port 80, but not for others) There are other tools which could be used to do the same with different types of packets, say, crafting a fake ICMP ECHO REPLY to see how good at being stateful are the firewalls on the path. Regards, Maciej --bcaec5523a56aab16804d4e6bf47 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Mon, Feb 4, 2013 at 8:41 AM, Dave Taht <da= ve.taht@gmail.com> wrote:
Heh. I turned out I'd left mtr ru= nning in another window...
Yeah, exactly. Decreasing TTLs suggest traceroute tools :-)
=C2=A0
As Ketan noted, it's best to decode what's in the ICMP TTL exc= eeded payload to see what packet triggered this.
=C2=A0
traceroute uses ICMP ECHO REQUEST
tracepath uses UDP
tcptraceroute uses TCP SYN (this tools is actually usefull to check if= your packets go different routes depending on the port they're going t= o, e.g. detecting a transparent proxy which shows up for port 80, but not f= or others)
=C2=A0
There are other tools which could be used to do the same with differen= t types of packets, say, crafting a fake ICMP ECHO REPLY to see how good at= being stateful are the firewalls on the path.
=C2=A0
Regards,
Maciej
=C2=A0
--bcaec5523a56aab16804d4e6bf47--