Traceroute Anomaly

From: Gregory Kuhn (freebsd-net_at_lists.ctch.net)
Date: 08/20/04

  • Next message: Chuck Swiger: "Re: Traceroute Anomaly" 
    Date: Fri, 20 Aug 2004 11:01:31 -0600
To: freebsd-net@freebsd.org

    Hello,

             I have discovered an anomaly (I am sure it was discovered long
    ago) when trying to traceroute to my FBSD 4.8 and 4.9 servers. Here are
    the details.

    1. From any of the FBSD boxes regardless if they are on the immediate
    network (206.168.231.96/28, 207.174.139.224/28) or on an entirely separate
    network (63.227.123.49/32) I am unable to traceroute to any of the other
    FBSD boxes.
             a. From the same FBSD box I am able to traceroute to say,
    www.yahoo.com
             b. From the same FBSD box I am able to ping any of the other FBSD
    boxes.
             c. From the same FBSD box I am able to trace to any of the other
    FBSD boxes using MTR.

    2. From a W2K box I am able to trace to any of the FBSD boxes using the
    DOS tracert command.

    3. One FBSD box was just brought up and as yet I have not setup the
    firewall rules. The current rule set on that particular box is;
             pass in from any to any
             pass out from any to any

             My question is this;
    Why can I do a traceroute using the DOS version of traceroute (tracert) to
    any of my FreeBSD boxes, but I am not able to do so from another FreeBSD
    box? Furthermore, it is not just from my own boxes that I am unable to do
    a traceroute. Using the traceroutes listed at www.traceroute.org I again
    am unable to trace back to my FBSD boxes.

    Here are examples of the traces;

     From the W2K box:
    C:\Documents and Settings\gkuhn>tracert maps.ctch.net
    Tracing route to maps.ctch.net [207.174.139.228]
    over a maximum of 30 hops:
    1 <10 ms <10 ms <10 ms 10.0.0.1
    2 50 ms 40 ms 41 ms 63-227-123-254.dnvr.qwest.net [63.227.123.254]
    3 60 ms 50 ms 50 ms dnvr-agw1.inet.qwest.net [207.225.112.29]
    4 60 ms 50 ms 50 ms thn-core-02.inet.qwest.net [206.196.128.215]
    5 61 ms 40 ms 40 ms dia-core-01.inet.qwest.net [205.171.8.81]
    6 70 ms 60 ms 80 ms kcm-core-01.inet.qwest.net [205.171.8.138]
    7 60 ms 80 ms 70 ms kcm-core-02.inet.qwest.net [205.171.29.126]
    8 70 ms 70 ms 70 ms dal-core-02.inet.qwest.net [205.171.8.141]
    9 70 ms 71 ms 80 ms dal-brdr-02.inet.qwest.net [205.171.25.50]
    10 70 ms 70 ms 100 ms acr1-so-2-0-0.Dallas.savvis.net
    [208.172.131.201]
    11 70 ms 80 ms 70 ms dcr1-as0-0.Dallas.savvis.net [208.172.131.45]
    12 90 ms 100 ms 90 ms acr2.Denver.savvis.net [208.172.162.62]
    13 101 ms 110 ms 120 ms bar1.Denver.savvis.net [208.172.162.3]
    14 90 ms 101 ms 100 ms rockynet.Denver.savvis.net [208.172.167.22]
    15 100 ms 120 ms 101 ms denver-core-2-fe-0-0.rockynet.com
    [206.168.230.1]
    16 90 ms 100 ms 100 ms colo2-denver.rockynet.com [208.139.193.147]
    17 100 ms 90 ms 100 ms maps.ctch.net [207.174.139.228]

     From a FBSD 4.8 Box;
    db1-10:10:20 ~: traceroute maps.ctch.net
    traceroute to maps.ctch.net (207.174.139.228), 64 hops max, 44 byte packets
      1 10.0.0.1 (10.0.0.1) 0.954 ms 0.927 ms 0.925 ms
      2 63-227-123-254.dnvr.qwest.net (63.227.123.254) 130.726 ms 163.887
    ms 77.019 ms
      3 dnvr-agw1.inet.qwest.net (207.225.112.29) 48.165 ms 48.638 ms 47.330 ms
      4 thn-core-02.inet.qwest.net (206.196.128.215) 47.467 ms 49.120
    ms 48.512 ms
      5 dia-core-01.inet.qwest.net (205.171.8.81) 47.737 ms 49.954 ms 52.074 ms
      6 kcm-core-01.inet.qwest.net (205.171.8.138) 79.195 ms 61.066
    ms 62.356 ms
      7 kcm-core-02.inet.qwest.net (205.171.29.126) 60.046 ms 61.297
    ms 62.098 ms
      8 dal-core-02.inet.qwest.net (205.171.8.141) 72.310 ms 69.674
    ms 71.816 ms
      9 dal-brdr-02.inet.qwest.net (205.171.25.50) 71.089 ms 69.552
    ms 71.685 ms
    10 acr1-so-2-0-0.Dallas.savvis.net (208.172.131.201) 71.973 ms 71.094
    ms 69.525 ms
    11 dcr1-as0-0.Dallas.savvis.net (208.172.131.45) 69.817 ms
    dcr2-as0-0.Dallas.savvis.net (208.172.131.53) 71.877 ms
    dcr1-as0-0.Dallas.savvis.net (208.172.131.45) 81.925 ms
    12 acr2.Denver.savvis.net (208.172.162.62) 93.542 ms 90.982 ms 94.390 ms
    13 bar1.Denver.savvis.net (208.172.162.3) 103.941 ms 234.812 ms 186.193 ms
    14 rockynet.Denver.savvis.net (208.172.167.22) 312.530 ms 217.025
    ms 134.002 ms
    15 denver-core-2-fe-0-0.rockynet.com (206.168.230.1) 144.291 ms 95.658
    ms 94.367 ms
    16 colo2-denver.rockynet.com (208.139.193.147) 97.248 ms 96.236
    ms 95.239 ms
    17 * * *
    18 * * *
    19 * * *
    20 * * *
    ^C

    Trace from above FSBD box using MTR:
    Hostname %Loss Rcv Snt Last Best Avg Worst
      1. 10.0.0.1 0% 3 3 1 1 1 1
      2. 63-227-123-254.dnvr.qwest.net 0% 3 3 49 45 47 49
      3. dnvr-agw1.inet.qwest.net 0% 3 3 48 48 48 48
      4. thn-core-02.inet.qwest.net 0% 3 3 49 48 50 54
      5. dia-core-01.inet.qwest.net 0% 3 3 53 47 50 53
      6. kcm-core-01.inet.qwest.net 0% 3 3 70 60 63 70
      7. kcm-core-02.inet.qwest.net 0% 3 3 60 58 60 62
      8. dal-core-02.inet.qwest.net 0% 3 3 69 69 71 73
      9. dal-brdr-02.inet.qwest.net 0% 3 3 70 70 70 71
    10. acr1-so-2-0-0.Dallas.savvis.net 0% 3 3 69 69 70 70
    11. dcr2-as0-0.Dallas.savvis.net 0% 3 3 70 70 70 72
    12. acr2.Denver.savvis.net 0% 3 3 90 90 91 93
    13. bar1.Denver.savvis.net 0% 2 3 104 104 108 111
    14. rockynet.Denver.savvis.net 0% 2 2 95 93 94 95
    15. denver-core-2-fe-0-0.rockynet.com 0% 2 2 94 94 95 96
    16. colo2-denver.rockynet.com 0% 2 2 96 96 98 99
    17. maps.ctch.net 0% 2 2 95 95 96 97

     From this looking glass in Canada at
    http://looking-glass.in.bellnexxia.net:8080/cgi-bin/lg.pl

    Translating "maps.ctch.net"...domain server (205.207.237.48) [OK]

    Type escape sequence to abort.
    Tracing the route to maps.ctch.net (207.174.139.228)

       1 dis40-toronto63-fe5-0-0.in.bellnexxia.net (205.207.238.210) 0 msec 0
    msec 0 msec
       2 core1-toronto63-pos11-5.in.bellnexxia.net (206.108.98.21) 0 msec 0
    msec 0 msec
       3 core3-toronto63-pos0-1.in.bellnexxia.net (64.230.242.93) 0 msec 4 msec
    0 msec
       4 core2-chicago23-pos0-0.in.bellnexxia.net (206.108.103.114) 12 msec 12
    msec 8 msec
       5 bx1-chicago23-pos11-0.in.bellnexxia.net (206.108.103.125) 8 msec 12
    msec 12 msec
       6 p5-2.IR1.Chicago2-IL.us.xo.net (207.88.50.173) [AS 2828] 12 msec 12
    msec 12 msec
       7 p5-0-0.RAR1.Chicago-IL.us.xo.net (65.106.6.133) [AS 2828] 12 msec 12
    msec 12 msec
       8 p6-0-0.RAR2.Denver-CO.us.xo.net (65.106.0.25) [AS 2828] 36 msec 36
    msec 32 msec
       9 p4-0-0.MAR2.Englewood-CO.us.xo.net (65.106.6.18) [AS 2828] 36 msec 36
    msec 36 msec
      10 p15-0.CHR1.Englewood-CO.us.xo.net (207.88.83.14) [AS 2828] 36 msec 32
    msec 36 msec
      11 66.236.86.10.ptr.us.xo.net (66.236.86.10) [AS 2828] 40 msec 40 msec 40
    msec
      12 border3.ge3-0-bbnet2.den.pnap.net (216.52.40.71) [AS 13790] 40 msec 36
    msec 40 msec
      13 rockynet-1.border3.den.pnap.net (63.251.181.222) [AS 13790] 44 msec 40
    msec 40 msec
      14 denver-core-2-fe-0-0.rockynet.com (206.168.230.1) [AS 13345] 40 msec
    40 msec 40 msec
      15 colo2-denver.rockynet.com (208.139.193.147) [AS 13345] 44 msec 40 msec
    44 msec
      16 * * *
      17 * * *
      18 * * *
      19 * * *

             Thank you in advance for any insight into why this is.
    Greg

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Chuck Swiger: "Re: Traceroute Anomaly"

    Relevant Pages

    • Re: Hp-parts down for several days
      ... -> Replacement parts. ... I think one can't trace a route inside HP. ... FYI, here's my traceroute: ... Tracing route to h20141.www2.hp.com ...
      (comp.sys.hp.hpux)
    • Re: AOL Servers Probing ???
      ... Speaking of AOL Proxies, I just got a Hit on Port 80 that seems a bit ... Traceroute before on another IP. ... Tracing route to AC982843.ipt.aol.com ... Trace complete. ...
      (microsoft.public.security)
    • Re: I cannot connect to ONE particular website
      ... Have you tried a traceroute to the site? ... Tracing route to soundclick.com ... over a maximum of 30 hops: ... Trace complete. ...
      (microsoft.public.windows.mediacenter)
    • Re: remote access failing . . .
      ... > When the OpenBSD box is up and I run traceroute from an externl site, ... This is consistent with the trace packets being blocked by the firewall. ... One often blocks incoming ICMP packets as a matter of course. ...
      (comp.unix.bsd.openbsd.misc)
    • Re: Tracing Access Attempts IDs?
      ... > Are these attemps successful? ... >> trace it back to the source. ... > traceroute, tracert on winXY systems, whois. ... > A foreign body and a foreign mind, ...
      (comp.security.firewalls)