icmp-type to enable traceroute

[K.C. Chan]

Does any one know whaty icmp-type to enable inorder to do traceroute for iptables? Thanks.

[Kodjo Agbenu]

Hello Michael,

As far as I know, the "traceroute" mechanism uses packets that could not be routed due to a too low number of hop counts.

The first host says to the first router : "could you reach that destination in 1 hop counts ?"

If it replies no, another query is attempted with 2 hop counts... until the destination host is reached.

I guess (but I'm not sure) that the ICMP packets to allow for the traceroute command to work should "icmp-net-unreachable" and "icmp-host-unreachable".

Good luck.

Kodjo

[K.C. Chan]

kodjo, I added network-unreachable and host-unreachle to the rule. But no luck, here's a samplet output of traceroute: "traceroute to www.yahoo.akadns.net (216.115.102.77), 30 hops max, 38 byte packets
traceroute: sendto: Operation not permitted
1 traceroute: wrote www.yahoo.akadns.net 38 chars, ret=-1
*traceroute: sendto: Operation not permitted
traceroute: wrote www.yahoo.akadns.net 38 chars, ret=-1
*traceroute: sendto: Operation not permitted"

Does any one have any idea? thanks.

[Volker Borowski]

Hello Michael,

I am also not so sure, but I checked my cisco for what it knows, and my best guess would be that you need

echo Echo (ping)
echo-reply Echo reply
host-unknown Host unknown
host-unreachable Host unreachable
information-reply Information replies
information-request Information requests
traceroute Traceroute
ttl-exceeded TTL exceeded
unreachable All unreachables

Unfortunately, I do not know the icmp-portnumbers for those signals, my cisco just offers the names.

Do not know if that helps
Volker

[messias]

Hi Michael,

You need to allow traceroute
following icmp types and codes:

TYPE = 0 - Echo Reply

TYPE = 8 - Echo Request

TYPE = 11 - Time Exceeded
Code 0 = TTL > 0

and if you need name reolution
you need DNS = udp 53


Best regards
Nico

[Paulo A G Fessel]

Michael,

AFAIK, the message you're seeing is not related to ICMP-type messages but to the fact that you're running traceroute as a non-root user.

Use the tips of our colleagues in the forum, make sure you're logged in as "root" and try again.

HTH
Paulo Fessel

[john savas]

UDP INCOMING TRACEROUTE

traceroute usually uses source port 32769:65535 dst port 33434:33523
default UDP base: 33434 to base+nhops-1

ICMP INCOMING TRACEROUTE
For outgoing traceroute.
Message Types: INCOMING Dest_Unreachable (3), Time_Exceeded (11)

For incoming traceroute.
Message Types: OUTGOING Dest_Unreachable (3), Time_Exceeded (11)
To block this, deny OUTGOING 3 and 11

[Christopher C. Weis]

I agree with Paulo on this one. The error message you're seeing is due to you not being root or traceroute not being suid root. I would recommend su'ing to root and trying this process again.

However, I did notice once before, with a customized 2.4.`early` kernel that I received a very similar error message when using ping. I haven't been following the LKML enough lately, but it's possible there was a bug in the kernel somewhere that kept the sendto() function from working properly. It may have been a problem with glibc also. I ended up rebooting just to see if I could shake the problem. It went away for a while, but returned. After upgrading and rebuilding the kernel, all was well. I'll be curious to see if your problem comes to this also.

Good luck!

[Ron Kinner]

Don't think it's a root issue. Looks more like the firewall is blocking it.

Are you using IPCHAINS? What do
ipchains -L output
and
ipchains -L input

say?

Ron

[Ron Kinner]

http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO-7.html

Shows how to get traceroute to work.

Ron

[Stuart Browne]

The dumb question is have you allowed 'udp' packets as well as these ICMP packets?

The outgoing probe is actually a UDP packet with low TTL values, and 'traceroute' sits waiting fo the ICMP replies of 'time exceed' and 'port unreachable' from the middling hosts.

NOTE: this is all int he man page for traceroute..