So now that we've reviewed many of the potential traceroute techniques,
let's move back into the demonstration environment
and show them in use with Scapy.
First thing we need to do is get into to Scapy obviously, clear out for space.
So the first thing we're going to do is we're going to make a packet
where the IP destination address is 192.124.249.7.
Now we're going to set the ID to 50,000 just to be unique.
We're going to set the TTL for a range from 1 to 30,
and then we're going to make it an ICMP packet with a type of 8,
which is an echo.
And then with that, we're going to pair that with unans=sr and that packet,
we're going to put a timeout of 10 seconds,
which I wouldn't generally recommend a timeout of that
short whenever you're doing a traceroute,
but for the purposes of time in this setting,
I'm putting that on there,
putting a filter of it of ICMP because we're only expecting to get
ICMP unreachable messages back for the most part,
and then with that, we hit Enter.
Okay, we received everything back that we were going to,
and then ordinarily, if we looked at this output of just what we got back,
it would look like this,
and it's hard to actually figure out what any of that is.
So one of the ways that we can pretty this up a little bit,
let me type the right clear command, is to use the output of the summary command,
so basically the show that we're, if we just use show,
it's showing you an end summary.
So in this case, we're going to use the output from the summary command,
so getting rid of the packet numbers and we're porting that into a lambda
function which basically puts together the TTL and the source address so it
should give you an output that's somewhat similar to what you're used to
seeing with the output of a traceroute.
And in this case, the TTL was the first number that's in each row,
and then the second number is the response we got back.
So to get out of my network, in this case,
we first hit 1.1 and then it goes through a private 10 network,
which is my wisp,
and then it goes out to the main public internet until it gets to the far end.
In order to ensure that you get an absolutely correct one,
what we found is two things, one, the timeout you may want to extend out,
but another parameter that's available on the sr command is
what's called the interparameter and what this does is it
dictates the amount of time between the packets that are sent
out and that's the time in seconds.
The problem with this is it doesn't extend how long the traceroute can take,
so it's not going to be as fast as without using it,
but it's a question of fast versus absolutely accurate.
Alright, now if we take that output and we list it out again,
we will see that our output is similar, but not the same,
but we know that from this one,
and keep in mind also that since this is only sending out one packet or HTTL,
you're not guaranteed that the path that the traffic takes is going
to be the same going over the public internet.
So sometimes it's that you're going to have some difference in your
output regardless of what utility you're going to have,
but know that using that interparameter will ensure that you get
the values mapped as correctly as possible.
So next,
what we're going to do is we're going to take a look at how to
do a traceroute using UDP instead of ICMP,
and to do that, go back to our packet here,
and instead of using ICMP, we'll send UDP,
sport we'll make random again, dport let's say 21,
there you go,
and then we would use the same sr command here and we get an output here,
and notice that there are some that are missing,
the 13,1235, so it didn't get a response to TTL 4,
the little,
and some of these are out of order because they came back in a different order.
So it's a little bit interesting by, you know,
without doing any additional processing on it.
And the final thing we're going to do is we're
going to try this with a TCP port, just use port 80,
send it out again.
Keep in mind that the filter is still the same because we're still
expecting the TTL exceeded message along the wire.
And here, we received back 16 different packets,
but again, they're a little out of order,
and of course, you can do a sort on it after the fact.
But this is what we received back whenever we send a TCP packet out to port
80 with the TTL set and the packets that we received back.
Now,
that's what we can do with traceroute using custom IP
packets and custom send and receives.
There is also a TCP traceroute command that's built into Scapy.
And in this case, since we're, by default,
going to be using port 80 as indicated up here,
the elevens, in this case that it's showing, are the equivalent of the flags.
So it's the equivalent of a RST ACK.
So that's the path that it's getting back the whole way until you get
as close as possible to that 192.124.249.7 address.
So with that,
we're going to finish up this demonstration section and move into our summary.