Backtrack 4: Information Gathering: Route: Tcptraceroute

The next tool up for review in the information gathering section is tcptraceroute. tcptraceroute is a traceroute implementation using TCP packets. The more traditional traceroute sends out either UDP or ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets are taking to reach the destination. The problem is that with the widespread use of firewalls on the modern Internet, many of the packets that traceroute sends out end up being filtered, making it impossible to completely trace the path to the destination. However, in many cases, these firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the firewall are listening for connections on. By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters.

Lets take a look at the options availbale:

I dont usually say this about a tool but I think this one is pretty dated. It hasn’t been updated since 2006. I was not able to get it to work in any of the examples shown below. I am actually going to flag this tool from removal in Backtrack.

For the following example I simply took these from the example.txt file which comes with the tools.

A classic firewalled webserver using plain old traceroute:

The same webserver using tcptraceroute:

If you are interested in some more examples here is the examples.txt that comes with the tool: