-
Notifications
You must be signed in to change notification settings - Fork 105
Closed
Labels
Description
If any ICMP message arrives during a dnstraceroute run, it will be confused with the expected ICMP_TTL_EXCEEDED, regardless of its true type, and its source IP will be displayed at the corresponding hop. This has a pretty high probability of occurrence for example on a DNS resolver, on which dnstraceroute is useful to analyze the recursion side, while the client side has a steady flow of ICMP_PORT_UNREACHABLE due to client-side session timeouts. It also occurs if anybody pings the machine.
To fix this, just as in traceroute, the incoming ICMP packets should be checked against (1) ICMP type (==TTL_EXCEEDED) and (2) L4 header (UDP ports).
farrokhi