Some routers and firewalls are configured to not pass ICMP echo requests or echo reply requests.
Attackers sometimes try to map out remote networks by pinging all the possible addresses and collecting
replies.
So blocking this type of traffic at the perimeter is fairly common.
Just because you do not receive a reply to a ping does not necessarily mean that the host is not available.
Traceroute is a computer network diagnostic tool for displaying the route or path of packets through
the internet between your computer and a specified destination computer.
It also measures the amount of time each hop took.
When you run the utility, it initiates the sending of a packet, including in the packet, a TTL,
a Time to Live Value, which is also known as a hop limit.
As the packet passes through a router.
The TTL is Decremented until when the TTL reaches zero, the packet is destroyed and an ICMP time exceeded
message is returned.
Traceroute works by setting the TTL for a packet to one, sending it towards the requested destination
host and listening for the reply.
When the initiation machine receives a time exceeded response, it examines a packet to determine where
the packet came from.
So this identifies the machine one hop away.
Then the tracing machine generates a new packet with TTL two and uses that response to determine the
machine two hops away and so on.
The command trace route is available on many modern operating systems.
On Unix like systems such as FreeBSD, macOS and Linux.
It's available as a command line tool.
On Unix like systems traceroute sends by default a sequence of UDP packets.
Traceroute is also graphically accessible in macOS with a network utility suite.
In Microsoft Windows.
It's named Tracert.
In Windows Traceroute sends ICMP echo requests instead of UDP packets.
For IPV six the tool sometimes has a name traceroute six or tracert six.
Let's look how the traceroute command operates in our host machine and virtual machines as well.
So I'm on my host machine.
This is Mac OS and I'll open a terminal screen command space to open the spotlight search bar and type
terminal.
Start the terminal app and now I'm on a terminal screen.
Traceroute is the command I'll use.
So if you run it with no parameter, you get a brief help about the usage of the command.
So now let's run the command with a target host.
We timed out in the first hop.
And in the second one as well, where it happens, no worries.
And yes, here are the other hops.
This is the path that the packets follow from my host machine to the target web server.
In macOS, you can also trace the packets with a graphical UI, which I mentioned before.
So go to the network utility tool.
Press Command and Space bar once more to open spotlight and type network utility and find it and open
it.
There's a trace route tab in the network utility window.
Just type the target host and click the trace button.
Let's see how it all works in Cali.
So now I'm in Cali and I have a terminal screen open type traceroute and hit enter.
So you'll see the help for this particular command.
And it's a bit more detailed than the one in Mac OS.
So now I want to show you the network configuration of Michael.
Go to Cali settings.
Click Network adapter.
And as you see, we run Cali in net mode where the host machine Mac provides network address resolution.
We'll talk about that soon for all network traffic and Cali shares the IP address of the host.
Now I want to test the network connection first, so I'll ping the Google DNS 8.8.8.8 and right, that's
no problem at all.
You can use Ctrl C Keys to End the Pink Man.
Well, not just don't use Ctrl L.
Okay.
Now I'll run the trace route with the target host and call.
The first hop is a gateway prepared by VMware for my virtual machines.
And as you can see, all the other hops are blocked.
We cannot trace packets from the VM in Nat mode.
So let's have a look at the traceroute command options once more.
Here there's an option uppercase T which sends TCP syn packets.
Now I'd like to try the command once more with this option.
Okay, so we have the first and the last hop this time.
So now I want to show you the command in a Windows system.
Here is my up to date Windows 8 system.
It has an IP.
Check the connection ping.
And yes, the network is running good.
Just where we want it.
Let's look at the network details first.
From the network and sharing center, click Ethernet zero and then the details button.
And here are the details.
Default gateway is 99.2.
Dhcp is 99.254.
As you know, these are the devices prepared by VMware for our Nat network.
So now I go to the settings of the VMware Fusion In network adapter.
We confirm that the VM is in net network mode.
Now I'm in the command prompt.
As I mentioned, the command is Tracert in Microsoft Systems, so write down the target host and press
enter.
So the first top is again the gateway.
And just like in Cali, since this is also in that mode, the requests for other hops are timed out.
So while the command is running, I'd like to show you the command help.
So just type tracert and hit enter.
So we didn't enter the host this time.
And here is a usage of the Tracert command.
Trace completed and there is no result given as expected, because we're in that mode.
I know you knew that, but I just wanted to make sure.
So now I'm going to run my Windows VM and bridge mode and try the command once more.
And once again click the hardware settings icon on the menu bar of VMware Fusion and Select Network
adapter.
So I'm using wi fi to connect to the internet right now, so I choose wi fi under the bridged networking
section.
Now this is the IP address assigned by the Dhcp and the subnet mask of the network again is set by Dhcp.
So we'll see how the Dhcp works.
Just stay with me here.
So as you see in the network and sharing center window, the active network disappeared as soon as I
changed the network adapter of the VM.
And a second, the new network is activated.
Click Ethernet zero and look at that the details button.
So click on that to see the network settings.
And those are the new ones.
So now we're in the 192.168.12. x IP block and we have a different Dhcp and gateway run by the network
admins of my office building.
So let's go back to the command prompt and trace the route of the packets once more.
So first I want to check the network, as I always do.
So I'll ping the Google DNS and yes, we have the Internet connection.
So now is the time to trace the route.
The first request is timed out.
Remember the results of my host machine?
The second request timed out as well.
And here are the other hops.
We now have the results.