I often run into a situation where I want to traceroute an IP without root or NET_RAW cap in Linux.

I have attempted to send a UDP packet with a small TTL but no ttl error is emitted at all. It seems that getting the TTL exceeded error requires using an ICMP socket. Is it possible to use UDP or TCP protocol only without involving ICMP while still getting notified for TTL error so that I can traceroute with limited capabilities?


Of course, you can use any protocol. Try tcptraceroute.

Or the standard traceroute.

from man page:

   -I, --icmp
          Use ICMP ECHO for probes

   -T, --tcp
          Use TCP SYN for probes

   -U, --udp
          Use UDP to particular destination port for tracerouting (instead
          of  increasing  the  port  per  each  probe). Default port is 53

   -UL    Use UDPLITE for tracerouting (default port is 53).

   -D, --dccp
          Use DCCP Requests for probes.

   -P protocol, --protocol=protocol
          Use raw packet of specified protocol for  tracerouting.  Default
          protocol is 253 (rfc3692).
  • Traceroute needs always raw sockets no matter the operating mode AFAIR – Rui F Ribeiro Jan 29 '19 at 12:45
  • 3
    @RuiFRibeiro stackoverflow.com/a/23119894 . cp $(which traceroute) . && ./traceroute google.com works fine for me as an unprivileged user. (The cp proves this is not due to set-uid root). – sourcejedi Jan 29 '19 at 12:57
  • 1
    (on Linux). Oh, and for setting the TTL, see stackoverflow.com/a/31066364 . Regarding this answer, note that traceroute --tcp does require root. It is UDP traceroute that Linux lets you do without privilege. – sourcejedi Jan 29 '19 at 12:59
  • @sourcejedi Interesting, it seems I am a bit outdated here. Thanks. – Rui F Ribeiro Jan 29 '19 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.