traceroute TCP equivalent for Windows

Question

I'm trying to determine where connectivity to an external host using a specific TCP port is being blocked. Traceroute for Windows only uses ICMP, and telnet will only tell me that the port is blocked and not where. Does anyone know of a Windows utility similar to traceroute that will achieve this?

Solution 1

You can use nmap 5.0 with --traceroute option. You will also get a portscan for free :).

If you want to test a specific port, you can use -p port option. (You should also use -Pn option so that nmap doesn't try to do a regular ICMP probe first). This is an example:

$ sudo nmap -Pn --traceroute -p 8000 destination.com
PORT     STATE SERVICE
8000/tcp open  http-alt

TRACEROUTE (using port 443/tcp)
HOP RTT  ADDRESS
1   0.30 origin.com (192.168.100.1)
2   0.26 10.3.0.4
3   0.42 10.1.1.253
4   1.00 gateway1.com (33.33.33.33)
5   2.18 gateway2.com (66.66.66.66)
6   ...
7   1.96 gateway3.com (99.99.99.99)
8   ...
9   8.28 destination.com (111.111.111.111)

If you're interested in a graphical tool, you can use zenmap, which also displays topology maps based on traceroute output.

Solution 2

Scapy has a tcp trace route function described in this Scapy tutorial. Scapy can be installed on Windows, here are the instructions. I am not positive that his function is available in the Windows version, but it might be.

It will help to know python, or at least some knowledge of OO (Object Oriented) programing, but you might not need it just to follow the tutorial I linked to. Scapy also assumes you have basic understanding of the OSI model I think.

Solution 3

I'm not sure if nmap --traceroute will work properly on Windows due to Windows ignoring requests for non-standard TTLs. I just get an oddly-shaped two-hop path to something that's about 10-20 hops away:

c:\Program Files (x86)\Nmap>nmap -Pn --traceroute -p 443 66.98.200.8

Starting Nmap 6.01 ( http://nmap.org ) at 2012-08-27 18:52 GMT Daylight Time
Nmap scan report for live.sagepay.com (195.170.169.9)
Host is up (0.21s latency).
PORT    STATE SERVICE
443/tcp open  https

TRACEROUTE (using port 443/tcp)
HOP RTT      ADDRESS
1   31.00 ms 192.168.192.2
2   62.00 ms 66.98.200.8

I'll post back if I find something fit for purpose that hasn't already been mentioned.

Solution 4

You can find a number of links googleing.

A Linux implementation on traceroute being able to use TCP protocol and having replaced the old implementation on many distros. Simple use the -T flag on those systems.

On Mac -P TCP does the job.

Historically a number of ad hoc tools were developed; among the other references there is a simple python script that can be used also specifing the port one needs to probe: tcptraceroute.py while one of the most popular is tcptraceroute by Michael Toren.

View more solutions

Comments

[Admin]

It is so weird that the question was closed with "It's difficult to tell what is being asked here." while so many people correctly understood what was asked for - a tool with functionality similar to Traceroute for Linux with options traceroute -T -p port_number --- linux.die.net/man/8/traceroute

[Maxwell]

note: Scapy traceroute function is available on Windows.

[Scott Munro]

The Wikipedia page has been deleted.

[kojiro]

When I run the above command on my nmap it actually does an ICMP traceroute. Also weird, you specify port 8000, but nmap is using port 443 for the actual traceroute. Why?

[ivan_pozdeev]

A sniffer should tell you what's happening. My guess is that some intermediate router/gateway tries to be a smart-aleck and handles the packets in an unusual way.

[Tanner]

The link to tcptraceroute by Michael Toren is dead