Re:Show HN: An async traceroute(1) implementation in Rust
by maxbond on Sunday September 25, 2022 @01:41AM
(#32969214)
They appear to be fingerprinting & dropping traceroutes specifically. Flipping it to reverse usually bypasses this.
I'd be totally satisfied if it just accepted a TTL to count down from, but you can do a lot better than counting down from 255.
You can usually infer how many hops away something is from the TTL by assuming it was originally the nearest power of 2. Failing that, you can use binary search to identify the distance pretty quickly.
None of this is foolproof by any means, each packet could take a different route, but it seems to work fine.
Of course, if you do include this feature and people start to use it, they'll probably just improve the fingerprint, so maybe it's self defeating anyway.
I'd be totally satisfied if it just accepted a TTL to count down from, but you can do a lot better than counting down from 255.
You can usually infer how many hops away something is from the TTL by assuming it was originally the nearest power of 2. Failing that, you can use binary search to identify the distance pretty quickly.
None of this is foolproof by any means, each packet could take a different route, but it seems to work fine.
Of course, if you do include this feature and people start to use it, they'll probably just improve the fingerprint, so maybe it's self defeating anyway.