c - 如何识别traceroute包？

Question

我正在使用 C 语言并使用 pcap 库来分析一个 cap 文件，该文件包含在 traceroute 执行期间发送/接收的数据包。我遇到的问题是识别从 traceroute 发送/接收的数据包，因为 cap 文件也包含其他数据包。

在尝试确定任何给定数据包是否来自 traceroute 时，是否有我可以检查的特定标准？或者这是不可能的？

如果您能提供任何帮助/建议，我们将不胜感激。

Answer 1

$ man traceroute

TRACEROUTE(8)             BSD System Manager's Manual            TRACEROUTE(8)

NAME
     traceroute -- print the route packets take to network host

    ...


     -I      Use ICMP ECHO instead of UDP datagrams.  (A synonym for "-P
             icmp"). 

    ...


     This program attempts to trace the route an IP packet would follow to   
     some internet host by launching UDP probe packets with a small ttl (time
     to live) then listening for an ICMP "time exceeded" reply from a gateway.
     We start our probes with a ttl of one and increase by one until we get an
     ICMP "port unreachable" (which means we got to "host") or hit a max 
     (which defaults to net.inet.ip.ttl hops & can be changed with the -m
     flag).  Three probes (changed with -q flag) are sent at each ttl setting
     and a line is printed showing the ttl, address of the gateway and round
     trip time of each probe.  If the probe answers come from different gate-
     ways, the address of each responding system will be printed.  If there is
     no response within a 5 sec. timeout interval (changed with the -w flag),
     a "*" is printed for that probe.

     We don't want the destination host to process the UDP probe packets so
     the destination port is set to an unlikely value (if some clod on the  
     destination is using that value, it can be changed with the -p flag).

因此，默认情况下，traceroute 数据包是发送到某个随机端口的 UDP 数据包；这使得它们有点难以与其他流量区分开来。

如果有人使用 -I 选项，它会使用 ICMP ECHO 数据包，这更容易与其他流量区分开来，虽然不容易区分，因为例如，来自“ping”命令的流量。

您可以尝试寻找 TTL 较小的数据包。