tracebox(1)

🦋 tracebox — a Middlebox Detection Tool, and yes you need her

Welcome to tracebox(1), bestie — General Commands Manual energy, main character tool. Keep reading, it's giving network forensics, iykyk.

✨ SYNOPSIS ✨

tracebox [OPTIONS] host [Lua arguments list ...]

---

💖 DESCRIPTION 💖

tracebox is a tool that lets you detect middleboxes on any path — literally anywhere between a source and any destination. Think of her as traceroute's cooler cousin: she uses ICMP replies to identify changes in the packets. 🔍

The way she pulls off the middlebox detection thing is genuinely so iconic: it comes from the observation that ICMP messages are often not as defined in RFC792. Like, no cap — it is quite common to receive an ICMP Time-to-Live exceeded message with the original datagram instead of 64 bits as described in the standard. 🙈

Why does this happen? Operating systems configured to reply with full ICMP (e.g., Linux, Cisco IOS-XR, etc.), plus the ICMP Multi-Part Messages extension that standardizes the fact that routers using MPLS tunnels reply with an ICMP message containing the full datagram. Slay.

If however tracebox receives an ICMP with only a partial probe in the payload, she'll let you know by appending a [PARTIAL] flag on the modification list. 💅

---

🎀 ARGUMENTS 🎀

Every argument you pass after the options, in conjunction with -s or -l, gets passed to the lua interpreter and is available in a global vector of strings named 'argv', in the order they appeared on the command-line. Cute, right? 🫶

The following options may be provided:

• -h — Display help and exit. (Bestie behaviour: she tells you everything then dips.)
• -n — Do not resolve IP adresses. 🚫
• -6 — Use IPv6 for static probe generated.
• -u — Use UDP for static probe generated.
• -d port — Use the specified port for static probe generated. Default is 80.
• -i device — Specify a network interface to operate with.
• -m hops_max — Set the max number of hops (max TTL to be reached). Default is 30. 🔥
• -M hops_min — Set the min number of hops (min TTL to be reached). Default is 1.
• -p probe — Specify the probe to send.
• -l inline_script — Run a script.
• -s script — Run a script file.
• -v — Print more information. (She's a talker, we love her for it.)
• -w — Show warnings when crafting packets.
• -f filename — Specify the name of the pcap file.
• -j — Change the output format to JSON. 🧚
• -t timeout — Timeout to wait for a reply after sending a packet. Accepts decimals, default is 1s.
• -S — Skip the privilege check at the start.

🚨 <red>Warning:</red> -S is to be used mainly for testing purposes, as it will cause tracebox to crash for some of its features! Like, fr fr, don't come for her when she falls apart.

If Tracebox was compiled with curl support:

• -c server_url — Specify a server where capture files of each session will be uploaded.
• -C — Same than -c, but use the default server.

---

🌈 EXAMPLES 🌈

tracebox -p IP/TCP/MPCAPABLE/mss(9000) bahn.de

tracebox medu.ir

---

Okay that's the whole page, you ate that. 💜

This was tracebox(1) from the tracebox General Commands Manual, dated March 18, 2015 — go forth and detect those middleboxes, bestie. ✨🎀🌸