Re: [Full-disclosure] 0trace - traceroute on established connections

2007-01-25 Thread Jon Oberheide
On Sun, 2007-01-14 at 00:49 +0100, Robert Święcki wrote: > Michal Zalewski wrote: > > > Note: this is a 30-minute hack that involves C code coupled with a cheesy > > shellscript. It may not work on non-Linux systems, and may fail on some > > Linuxes, too. It could be improved in a number of ways -

Re: [Full-disclosure] 0trace - traceroute on established connections

2007-01-15 Thread Robert Święcki
Michal Zalewski wrote: > Note: this is a 30-minute hack that involves C code coupled with a cheesy > shellscript. It may not work on non-Linux systems, and may fail on some > Linuxes, too. It could be improved in a number of ways - so if you like > it, rewrite it. Slightly rewritten version in C,

Re: [Full-disclosure] 0trace - traceroute on established connections

2007-01-10 Thread Jon Oberheide
LFT is similar to tcptraceroute in that it uses TCP SYN probes. As Michal stated in his original message, 0trace is different as it piggybacks on an already established TCP connection. Regards, Jon Oberheide On Tue, 2007-01-09 at 09:03 +0100, Alessandro Dellavedova wrote: > Hi, > > am I wrong

Re: [Full-disclosure] 0trace - traceroute on established connections

2007-01-09 Thread Michal Zalewski
On Tue, 9 Jan 2007, Alessandro Dellavedova wrote: > am I wrong or the mechanism that you implement is similar to the one > implemented in lft (Layer Four Traceroute http://pwhois.org/lft/ ) ? No, what you describe is similar to tcptraceroute, from what I understand (they use stray SYNs or RSTs or

Re: [Full-disclosure] 0trace - traceroute on established connections

2007-01-09 Thread Alessandro Dellavedova
Hi, am I wrong or the mechanism that you implement is similar to the one implemented in lft (Layer Four Traceroute http://pwhois.org/lft/ ) ? From the homepage: "LFT is the all-in-one traceroute tool because it can launch a variety of different probes using both UDP and TCP layer-4 protoco

Re: [Full-disclosure] 0trace - traceroute on established connections

2007-01-08 Thread Michal Zalewski
On Sun, 7 Jan 2007, Michal Zalewski wrote: > [ Of course, I might be wrong, but Google seems to agree with my > assessment. A related use of this idea is 'firewalk' by Schiffman and > Goldsmith, a tool to probe firewall ACLs; another utility called > 'tcptraceroute' by Michael C. Toren imple