使用 tcp 数据包的 Traceroute 只需一跳即可到达目的地

Traceroute using tcp packets reach the destination in just one hop

我正在研究一些有用的 unix 网络工具,如 traceroute,我发现使用 tcp 数据包而不是使用 udp 或 icmp 数据包的奇怪行为。

特别是,如果我尝试跟踪任何网站,系统只需一跳即可到达目的地。这些是我做过的一些试验:

$ traceroute -T google.com
traceroute to google.com (216.58.209.46), 30 hops max, 60 byte packets
 1  mil07s12-in-f14.1e100.net (216.58.209.46)  10.316 ms  10.263 ms  10.241 ms

$ traceroute -T tomshw.com
traceroute to tomshw.com (64.190.63.111), 30 hops max, 60 byte packets
 1  64.190.63.111 (64.190.63.111)  2.940 ms  2.900 ms  2.878 ms

$ traceroute -T corriere.it
traceroute to corriere.it (185.53.36.36), 30 hops max, 60 byte packets
 1  cache.corriere.it (185.53.36.36)  6.123 ms  6.063 ms  6.017 ms

$ traceroute -T facebook.com
traceroute to facebook.com (157.240.203.35), 30 hops max, 60 byte packets
 1  edge-star-mini-shv-01-mxp2.facebook.com (157.240.203.35)  2.889 ms  2.855 ms  2.838 ms

$ traceroute -T interno.gov.it
traceroute to interno.gov.it (99.86.153.34), 30 hops max, 60 byte packets
 1  server-99-86-153-34.mxp64.r.cloudfront.net (99.86.153.34)  5.960 ms  5.923 ms  5.892 ms

而是使用 udp 数据包或 icmp 数据包以合理的跃点数到达目的地:

$ traceroute google.com
traceroute to google.com (216.58.209.46), 30 hops max, 60 byte packets
 1  _gateway (192.168.182.1)  24.216 ms  24.172 ms  24.155 ms
 2  192.168.10.1 (192.168.10.1)  24.143 ms  24.117 ms  24.088 ms
 3  82.113.192.132 (82.113.192.132)  33.846 ms  33.818 ms  33.800 ms
 4  185.25.74.93 (185.25.74.93)  47.396 ms  47.379 ms  47.367 ms
 5  hu-0-0-1-2.ncs55-1-jn.network.twt.it (185.25.74.130)  47.350 ms  47.337 ms  54.092 ms
 6  142.250.169.248 (142.250.169.248)  54.073 ms  32.662 ms  35.847 ms
 7  * * *
 8  108.170.245.65 (108.170.245.65)  35.724 ms  61.251 ms 216.239.40.200 (216.239.40.200)  51.454 ms
 9  108.170.245.73 (108.170.245.73)  131.758 ms 108.170.232.181 (108.170.232.181)  105.612 ms 108.170.245.73 (108.170.245.73)  131.720 ms
10  172.253.71.141 (172.253.71.141)  61.114 ms mil07s12-in-f14.1e100.net (216.58.209.46)  61.095 ms  61.126 ms

$ traceroute -I google.com
traceroute to google.com (216.58.209.46), 30 hops max, 60 byte packets
 1  _gateway (192.168.182.1)  21.592 ms  37.848 ms  41.086 ms
 2  192.168.10.1 (192.168.10.1)  47.584 ms  50.838 ms  54.088 ms
 3  82.113.192.132 (82.113.192.132)  57.354 ms  63.878 ms  63.870 ms
 4  185.25.74.93 (185.25.74.93)  63.861 ms  63.846 ms  63.901 ms
 5  hu-0-0-1-2.ncs55-1-jn.network.twt.it (185.25.74.130)  63.891 ms  1457.578 ms  1457.568 ms
 6  142.250.169.248 (142.250.169.248)  70.296 ms  14.804 ms  33.535 ms
 7  209.85.242.39 (209.85.242.39)  82.764 ms  82.748 ms  82.731 ms
 8  108.170.232.169 (108.170.232.169)  82.712 ms  82.696 ms  82.745 ms
 9  mil07s12-in-f14.1e100.net (216.58.209.46)  225.226 ms  228.457 ms  228.433 ms

查看 Wireshark,我有一个 synack 用于第一个 ttl = 1 的 syn 探测器,这很奇怪,因为它应该过期。

最后,尝试更改端口,例如更改为 22,它似乎有点工作:

$ traceroute -T -p 22 google.com
traceroute to google.com (216.58.209.46), 30 hops max, 60 byte packets
 1  _gateway (192.168.182.1)  10.014 ms  9.943 ms  9.921 ms
 2  192.168.10.1 (192.168.10.1)  13.022 ms  12.947 ms  12.917 ms
 3  82.113.192.132 (82.113.192.132)  38.882 ms  38.855 ms  38.832 ms
 4  185.25.74.93 (185.25.74.93)  38.802 ms  38.846 ms  38.818 ms
 5  hu-0-0-1-2.ncs55-1-jn.network.twt.it (185.25.74.130)  38.790 ms  38.765 ms  38.748 ms
 6  142.250.169.248 (142.250.169.248)  38.649 ms  10.215 ms  10.256 ms
 7  * * *
 8  * * *
...
29  * * *
30  * * *

$ traceroute -T -p 22 tomshw.com
traceroute to tomshw.com (64.190.63.111), 30 hops max, 60 byte packets
 1  _gateway (192.168.182.1)  5.657 ms  5.594 ms  5.567 ms
 2  192.168.10.1 (192.168.10.1)  12.123 ms  12.099 ms  12.075 ms
 3  82.113.192.132 (82.113.192.132)  17.724 ms  20.958 ms  20.934 ms
 4  185.25.74.93 (185.25.74.93)  24.177 ms  24.154 ms  24.198 ms
 5  te-0-2-0-1.asr9kp-jn.network.twt.it (82.113.194.246)  20.835 ms  20.812 ms  20.817 ms
 6  81.25.202.185 (81.25.202.185)  24.095 ms  15.309 ms  18.446 ms
 7  mno-b3-link.ip.twelve99.net (62.115.144.98)  18.414 ms  14.755 ms  17.877 ms
 8  ffm-bb2-link.ip.twelve99.net (62.115.116.172)  29.702 ms  39.470 ms  39.454 ms
 9  mcn-b3-link.ip.twelve99.net (62.115.124.47)  39.430 ms  39.407 ms  39.374 ms
10  internetx-ic332227-mcn-b2.ip.twelve99-cust.net (62.115.160.178)  39.350 ms  39.355 ms  39.329 ms
11  91.195.241.102 (91.195.241.102)  39.269 ms  39.239 ms  164.766 ms
12  91.195.241.118 (91.195.241.118)  167.982 ms  167.951 ms 91.195.241.114 (91.195.241.114)  207.035 ms
13  64.190.63.111 (64.190.63.111)  206.969 ms  206.940 ms  203.627 ms

对这种行为的解释是什么?我使用的操作系统是默认设置的 Kubuntu 21.10,所以我会排除代理或类似的东西。

traceroute 人说:

tcp -T

Well-known modern method, intended to bypass firewalls. Uses the constant destination port (default is 80, http).

看来您的网络中有某种 80 端口的隐形代理