Weird TCP/IP Behavior... suspicious..

[Marie-Josee Cormier]

I have this weird thing going on with my HPUX 11i box.

All I tried to do is a traceroute from our internal box to our public DNS server, and all of a sudden, from out firewall logs, my HPUX started doing something wich looks like a port scan on the DNS server.

I tried tracerouting other IPs, and it does the same thing everytime. Here's attached a printscreen of our firewall.

Please can you help me see through this?

Thanks

[Simon Hargrave · Accepted solution]

Don't worry this is perfectly normal. traceroute sends packets with increasing TTL (time to live)'s on UDP ports, starting from a base port. If you read the man page for traceroute see the -p switch.

Basically on the first itteration traceroute sends a packet to your destination with TTL 1 to udp port 33434. Next it sends with TTL 2 to 33435, then TTL3 to 33436...until it gets a port unreachable message (which means it hit the server) instead of a TTL expired message.

But don't worry it's doing exactly what it was coded to do.

[Marie-Josee Cormier]

Ok, always thought a trace route worked on ICMP.. Like windows clients does. So I guess I have to enable some more ports.

Thanks

[Simon Hargrave]

If you want to override the default use of UDP then you can provide the -I switch to traceroute, which will force it to use ICMP instead of UDP.

[Marie-Josee Cormier]

yess.. worked like a charm with the -I option!

Thanks

[Tor-Arne Nostdal]

Hi Marie-Josee
Another useful traceroute option is the -F which will "disable fragmentation", and then specify packetsize parameter.

In case you have "suspicious" problems on WAN communication it might turn out that the problem relates to MTU Size (maximum transfer unit).

It might be that a router set "dont fragment" on communication, and thus prevent the dynamically split/repack of packages (to include headers aso.).

I've seen this when communicating over MPLS, with IPsec, SSH.

/Tor-Arne