Results 1 to 9 of 9

Thread: traceroute, unknown *

  1. #1
    Senior Member br_fusion's Avatar
    Join Date
    Apr 2002
    Posts
    167

    traceroute, unknown *

    I have a general question about traceroute. (i'm running Knoppix STD 3.2)

    Scenario:

    All traffic going into the LAN runs through one router(or so I think), but all traffic leaving the router goes out through a different router. (They have different IP's)

    I run a traceroute to the outgoing router and it hops right to it, showing only its IP.
    However when I traceroute to the incoming router, the first and only hop is the outgoing router. But it has changed a little bit. There is an * before the IP of the outgoing router. What does this mean?

    No its not,
    1.***
    2.<router ip>

    It looks like,
    1.*<routerip>

    Can someone explain?

    thanks

  2. #2
    Elite Hacker
    Join Date
    Mar 2003
    Posts
    1,407
    I'm just going to make an educated guess since nobody else is answering. I think that on the second traceroute it is going out through the outgoing router and from there it can't see your incoming router, which is good because you don't want anyone on the internet to see your router. I guess the star means it can't find the address. I'm sure someone else has the real answer though.

    edit
    I think I misunderstood you configuration, but when I did a tracert in windows for microsoft.com it had a * for the last few hops because the request timed out. Maybe that's what it means( the request has timed out). I also have two routers, but one is configured to act like a switch or hub. I tried to traceroute the inner one and I got two hops, and both were the ip of the router I was tracerouting.

  3. #3
    Senior Member
    Join Date
    Sep 2003
    Posts
    179

    forgot to add

    I think you also might be confused about the router setup. I think you might be using one router, the two diffrent ip's come from the fact that each port on a router has a diffrent IP. Say you have a two port router. Port A is the connection to the internet with an ip of 10.0.0.1 (lets say) and port B is the connection to your internal connection 66.218.71.198 (yahoo's ip). This would explain why your getting two diffrent IP's, the star might have something to do with passing through the router. Not really sure though.

    DeafLamb

    EDIT: by the way, i read the man page on traceroute and a couple of tutorials I googled, couldn't find anything about one star. Hope someone has the answer.

  4. #4
    Senior Member br_fusion's Avatar
    Join Date
    Apr 2002
    Posts
    167
    Thanks for the response fellas.


    Also I ran port scans against both IPs. They are both running CISCO IOS 12.X. Deaflamb you thanks for the help.

  5. #5
    Senior Member
    Join Date
    Oct 2003
    Posts
    111
    h3r3tic, you got it right, whenever you see a * in front of an IP dest, you've missed (timed-out) a hop...Just thought I'd put in my 2 cents
    Creating further mindless stupidity....through mindless automation.

  6. #6
    Senior Member
    Join Date
    Jan 2002
    Posts
    458
    a single * also is very common when the packet times out because it has to ARP for the IP address the first time. If you a traceroute back-to-back, does the second one do the same thing?

  7. #7
    Senior Member br_fusion's Avatar
    Join Date
    Apr 2002
    Posts
    167
    But could it be possible to have two routers? One for outgoing and one for incoming. More enumeration makes it seem this way.

    But I cant see the point of having this kind of set up.

  8. #8
    Senior Member
    Join Date
    Mar 2003
    Posts
    372
    most likely it's just different physical ports on your router. The "incoming" traffic... is the IP range one of the restricted ranges? i.e. 192.168.x.x

    and is your "outgoing" traffic going through a public IP address?

    Give a man a match and he will be warm for a while, light him on fire and he will be warm for the rest of his life.

  9. #9
    Senior Member br_fusion's Avatar
    Join Date
    Apr 2002
    Posts
    167
    I know this is a bad idea, but here are part of the IP's.

    10.254.*.*
    10.51.*.*

    Which makes them both private IPs. Sorry I didnt' mention this before.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •