Now let's move on from talking about port scanning and talk about
how Scapy can be used to perform traceroutes.
A traceroute is a tool that is essential to any IT
worker who handles devices on a network,
and for a network security professional,
it is a regular tool that is used to map out the structures
of a network by looking at the different hop that a packet
takes as it traverses a network.
There are two main ways the traceroute is used in common tools through the
use of ICMP alone or using a combination of UDP and ICMP.
Regardless of the method used, the basics are essentially the same.
A series of packets are sent towards a destination,
each with the value of their TTL fields sequenced starting
at 1 and usually going up to around 30.
The effect of the TTL field is that it limits the number of hops that a
specific packet can take before being stopped and a TTL exceeded message
being sent back to the original sender.
The initial messages sent out will typically use either ICMP
as an echo request or as a UDP packet with a random source
and destination port number.
Should the packet exceed its TTL on a device,
it is supposed to send back an ICMP message which the traceroute tool
will listen for and record the source IP addresses of.
When you combine each of these return packet responses together,
you can determine the path that it took through the network,
and while it isn't as common,
it is also possible to use TCP as this initial packet.
Since TCP isn't typically as fast as ICMP or UDP,
the trace can take a bit more time,
but it helps in the troubleshooting of points on a network where
TCP traffic is being filtered or blocked on top of the basic path
information that can be collected.
And so now with this quickly covered,
let's move back into the demonstration environment and show how we can perform
each of these different types of traceroute using Scapy.