ASTRACEROUTE(8)

✨ ASTRACEROUTE(8) ✨ — the autonomous system trace route utility, bestie edition 🦋

okay so before we even start: this is part of the netsniff-ng toolkit, and it's literally called astraceroute 💅

---

🌸 NAME 🌸

astraceroute</purgle> — autonomous system trace route utility

(yeah that's it, that's the whole name section, we're keeping it iconic)

---

🎀 SYNOPSIS 🎀

astraceroute [options]

that's the whole vibe. options only. no positional args, no drama.

---

💖 DESCRIPTION 💖

so astraceroute is this lil utility that gets you path information in a traceroute-ish way, except it ALSO serves you geographical location info on the side 🍓. like, it tracks the route a packet takes from your local host all the way to the remote host by successively bumping up the IP's TTL field, starting from 1, and manifesting that every intermediate node will send an ICMP TIME_EXCEEDED notification back to your local host once the TTL value gets decremented down to 0. lowkey a whole relay race 🏃♀️

astraceroute supports IPv4 AND IPv6 queries, and it'll display country and city info (if available), the AS number that hop belongs to, and its ISP name. it also gives you timing info and reverse DNS data, because why would it gatekeep 👑

and because astraceroute is soooo configurable, you can also gather some extra useful info about a hop regarding what it does and does not allow to pass through. how? by using clear text strings for probing DPIs or ``great firewalls'' to figure out whether they'll filter out blocked critical keywords. ngl this tool might be a really good starting point for further in-depth analysis of those kinds of systems 🔍

---

✨ OPTIONS ✨

• -H <host>, --host <host> — hostname or IPv4 or IPv6 address of the remote host where the AS route should be traced to. if you're passing an IPv6 address or host, you must use -6. IPv4 is the default, no cap.
• -p <port>, --port <port> — TCP port for the remote host to use. if you don't specify, the default port is 80.
• -i <device>, -d <device>, --dev <device> — networking device to start the trace route from, like eth0, wlan0. yes you get two short flags, we love options 💅
• -b <IP>, --bind <IP> — IP address to bind to instead of the network device's address. for an IPv6 address you gotta specify -6.
• -f <ttl>, --init-ttl <ttl> — initial TTL value to be used. super handy if you're not interested in the first n hops and only want the ones after. default initial TTL is 1.
• -m <ttl>, --max-ttl <ttl> — maximum TTL value to be used. unless you say otherwise, max TTL is 30. once it hits that, astraceroute exits, periodt.
• -q <num>, --num-probes <num> — how many queries to do on a particular hop. default is 2 query requests.
• -x <sec>, --timeout <sec> — the probe response timeout in seconds, aka the max time astraceroute waits for an ICMP response from the current hop. default is 3 seconds.
• -X <string>, --payload <string> — drops an ASCII cleartext string into the packet payload. cleartext with whitespace in it has to go in quotes (e.g.: "censor me").
• -l <len>, --totlen <len> — total length of the packet. payload that doesn't have a cleartext string in it gets padded with random garbage 🗑️
• -4, --ipv4 — use IPv4 only requests. this is the default.
• -6, --ipv6 — use IPv6 only requests. must be used when passing an IPv6 host as an argument.
• -n, --numeric — tells astraceroute to NOT do reverse DNS lookup for hop replies. the opposite option is -N.
• -u, --update — invokes the built-in geo-database update mechanism to grab Maxmind's latest version. to configure search locations for databases, the file /etc/netsniff-ng/geoip.conf holds the possible addresses. so if you wanna save bandwidth or mirror Maxmind's databases (to dodge their traffic limit policy 👀), you can drop different hosts or IP addresses into geoip.conf, separated by a newline.
• -L, --latitude — also show latitude and longitude of hops. 🌍
• -N, --dns — tells astraceroute to DO reverse DNS lookup for hop replies. the opposite option is -n.
• -S, --syn — use TCP's SYN flag for the request.
• -A, --ack — use TCP's ACK flag for the request.
• -F, --fin — use TCP's FIN flag for the request.
• -P, --psh — use TCP's PSH flag for the request.
• -U, --urg — use TCP's URG flag for the request.
• -R, --rst — use TCP's RST flag for the request.
• -E, --ecn-syn — use TCP's ECN flag for the request.
• -t <tos>, --tos <tos> — explicitly specify IP's TOS.
• -G, --nofrag — set IP's no fragmentation flag.
• -Z, --show-packet — show and dissect the returned packet. 🔬
• -v, --version — show version information and exit.
• -h, --help — show user help and exit.

---

🌈 USAGE EXAMPLE 🌈

okay bestie, real talk, here's how you'd actually run this thing:

astraceroute -i eth0 -N -S -H netsniff-ng.org

this sends out a TCP SYN probe via the ''eth0'' networking device to the remote IPv4 host netsniff-ng.org. this request is most likely to pass. also, it tells astraceroute to do reverse DNS lookups for each hop. ✅

astraceroute -6 -i eth0 -S -E -N -H www.6bone.net

in this one, a TCP SYN/ECN probe for the IPv6 host www.6bone.net is being performed. again, the ''eth0'' device is being used, plus a reverse DNS lookup for each hop. 💜

astraceroute -i eth0 -N -F -H netsniff-ng.org

here we send out a TCP FIN probe to the remote host netsniff-ng.org. again, on each hop a reverse DNS lookup is done and the queries are transmitted from ''eth0''. IPv4 is used.

astraceroute -i eth0 -N -FPU -H netsniff-ng.org

like most of the other examples, we do a trace route to IPv4 host netsniff-ng.org, and this time we do a TCP Xmas probe 🎄 (yes that's the real name, we don't make the rules).

astraceroute -i eth0 -N -H netsniff-ng.org -X censor-me -Z

in this example we have a Null probe to the remote host netsniff-ng.org, port 80 (default), and this time we append the cleartext string "censor-me" into the packet payload to test whether a firewall or DPI will let this string pass. such a trace could be done once without and once with a blocked string to gather possible info about censorship. 🕵️♀️

---

🫶 NOTE 🫶

if a TCP-based probe fails after a number of retries, astraceroute will automatically fall back to ICMP-based probes to pass through firewalls and routers used in load balancing, for example. it's got a whole backup plan, we stan resilience 💪

to gather more information about astraceroute's displayed AS numbers, see e.g.: http://bgp.he.net/AS<number>.

---

💀 BUGS 💀

the geographical locations are estimated with the help of Maxmind's GeoIP database and can differ from the real physical location. to decrease the possible errors, update the database regularly using astraceroute's --update option. 🙈

at some point in time, we need a similar approach to gather more reliable path information, such as in the paris-traceroute tool.

due to the generic nature of astraceroute, it currently has a built-in mechanism to stop the trace after a fixed number of hops, since the configurable TCP flags can have anything included. it is possible to decrease this number of course. in the future, if a SYN probe is sent out, there should be a listener so that we can stop the trace if we detect a handshake in progress. 👑

---

⭐ LEGAL ⭐

astraceroute is licensed under the GNU GPL version 2.0.

---

📜 HISTORY 📜

astraceroute was originally written for the netsniff-ng toolkit by Daniel Borkmann. it is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel Borkmann <dborkma@tik.ee.ethz.ch>. 🫡

---

🔥 SEE ALSO 🔥

netsniff-ng(8), trafgen(8), mausezahn(8), ifpps(8), bpfc(8), flowtop(8), curvetun(8)

---

💜 AUTHOR 💜

manpage was written by Daniel Borkmann.

---

🧚 COLOPHON 🧚

this page is part of the Linux netsniff-ng toolkit project. a description of the project, and info about reporting bugs, can be found at http://netsniff-ng.org/.

---

and that's the whole page, bestie! 💅 this version of the manpage is from the Linux crew and it's dated 03 March 2013 — so yeah, retro but still serving. go trace some routes, ily, bye 🦋✨