Sunday, August 30, 2009

How Traceroute Works

Traceroute

What is Traceroute?

It is an application layer implementation to find the hops when a packet traverses to a destination.

What are the Protocols Used in Traceroute?

Traceroute works with combination of both ICMP and UDP. It mainly relies on ICMP Time-to-Live Exceeded (Type 11)

How it Works?

When you execute a traceroute command (ie traceroute www.yahoo.com), your machine sends out 3 UDP packets with a TTL (Time-to-Live) of 1. When those packets reach the next hop router, it will decrease the TTL to 0 and thus reject the packet. It will send an ICMP Time-to-Live Exceeded (Type 11), TTL equal 0 during transit (Code 0) back to your machine - with a source address of itself, therefore you now know the address of the first router in the path.

Next your machine will send 3 UDP packets with a TTL of 2, thus the first router that you already know passes the packets on to the next router after reducing the TTL by 1 to 1. The next router decreases the TTL to 0, thus rejecting the packet and sending the same ICMP Time-to-Live Exceeded with its address as the source back to your machine. Thus you now know the first 2 routers in the path.

This keeps going until you reach the destination. Since you are sending UDP packets with the destination address of the host you are concerned with, once it gets to the destination the UDP packet is wanting to connect to the port that you have sent as the destination port, since it is an uncommon port, it will most like be rejected with an ICMP Destination Unreachable (Type 3), Port Unreachable (Code 3). This ICMP message is sent back to your machine, which will understand this as being the last hop, therefore traceroute will exit, giving you the hops between you and the destination.

The UDP packet is sent on a high port, destined to another high port. On a Linux box, these ports were not the same, although usually in the 33000. The source port stayed the same throughout the session, however the destination port was increase by one for each packet sent out.

One note, traceroute actually sends 1 UDP packet of TTL, waits for the return ICMP message, sends the second UDP packet, waits, sends the third, waits, etc, etc, etc.

If during the session, you receive * * *, this could mean that that router in the path does not return ICMP messages, it returns messages with a TTL too small to reach your machine or a router with buggy software. After a * * * within the path, traceroute will still increment the TTL by 1, thus still continuing on in the path determination.

But what about the non unix implementation, ahhh.. Nothing but it uses fully ICMP messages for trace.. Instead of UDP it will use ICMP. One more twist, since it is ICMP there is no port concept.. and the last hop will give an ICMP Reply.. 

Finally, if you want use ICMP for traceroute in unix, there is a way provided you got admin privileges use "- I" switch in traceroute. 

Sunday, June 7, 2009

DDNS - Dynamic Domain Name System

I remember my previous Employer, Mr. Noby E.A. (MD, Craysol Technologies (Inida) Pvt. Ltd; who wrote a VB program to solve the dynamic ip address problem (there was no public IP available from ISP) he faced while hosting a mail server in his office. To resolve this, he wrote a application in VB to capture the current leased ip address (allocated by ISP DHCP) of his mail and update it in a small database located in a remote server published in internet. So before sending anything to his mail server, he will read the database from the public server for the latest ip address of mail server and put it as destination address.. But twas a small problem, at times after fetching the latest public ip of mail server, ISP DHCP renews the IP lease of mail server, hence the message lost.

Again after some time I started thinking about a vpn connectivity from an office which doesn't have public address, so the idea of DDNS came,

Before explaining DDNS, I hope you all have a good idea about DNS, For those who dont know, DNS is the one to one mapping between name to ip address. But in DNS its will not get updated dynamically and it may take even more than 24 hrs to get updated in the root DNS servers. Here come DDNS,

What is DNS?

DNS (Domain Name Service) is the Internet service/protocol which provides the translation between a FQDN, or domain name, and its associated IP address. A DNS server is a computer that is running the DNS service/protocol. Every internet domains must be assigned a DNS server or set of DNS servers to be able to resolve names for that domain.

For example, if you were to type in "mail.mycompany.com", your computer would lookup who the DNS servers were for the domain mycompany.com. It would then query that DNS server for the IP address of the name mail.mycompany.com. At that point, the DNS server would return the IP Address associated with mail.mycompany.com and then your computer would connect to that IP Address.

But what happens if your IP address changes periodically such as if your machine is connected to your internet service provider who is providing you a dynamic IP Address via DHCP?

What is Dynamic DNS?

DDNS (Dynamic Domain Name Service) was created to solve this problem of giving a name to devices whose IP addresses change continually. So who is most likely to use Dynamic DNS? Well, static IP Addresses or web hosting accounts are relatively expensive. And there were alot of people who had a perfectly good computers at home behind their dedicated internet connection (cable or DSL). They wanted to use that machine as a server, for example, a web server.

But if someone typed "www.mycompany.com", there needed to be a service that could keep track of what the latest IP Address assigned to your computer was so that it could return the correct IP Address of your computer to a requesting computer. In a nutshell, that is what Dynamic DNS does.

How Does Dynamic DNS Work?

There are two components that are needed for Dynamic DNS to work. One is a client side component that will send the latest IP Address of the computer or device whenever it changes. And the second component is a server side DNS service which will receive the IP Address update from the client side component and also service DNS requests.

The client component is typically a piece of software you install on your computer that will monitor your IP address and forward it to the server component whenever the IP Address changes. Some of the newer cable/dsl modems and firewalls have this capabilty built in which eliminates the need to install client side software on your computer. There are lots of available DDNS client software that vary from freeware to shareware.

The server component for Dynamic DNS is typically provided by a hosted service provider that specializes in Dynamic DNS. Some provide this service for free while others charge a minimal fee. In addition, sometimes your domain registrar will also provide Dynamic DNS services.

Following are some of the DDNS Service Providers

* No-IP
* EveryDNS.net
* FreeDNS
* Dynamic Network Services, Inc
* ZoneEdit
* DHS International
* DNS2Go
* ChangeIP.com
* ThatIP.com
* Dynup.net
* DynDNS.dk
* DNS Park, LLC.
* DNS Made Easy
* DyNS
* DtDNS
* DynIP
* Dynu Systems Inc.
* dns.widge
* Domain DNS
* ZA NiC
* miniDNS.net
* Open Domain Server
* DNS Wizard Corporation
* GnuDIP Dynamic DNS
* Constant Time Software
* StaticCling
* HomePC.org
* SelfHosT
* PlanetDNS
* ddns.nu
* yi.org
* Art of DNS
* yyWeb
* dyn.ca
* DHIS.org
* Dyn.ee
* 2MyDNS.com
* IWAS2 Tech's DNS Services
* Microtech Dynamic DNS
* MyServer.org
* WebReactor Networks
* Nikhilino Online
* DynDNS Info
* Continuum CMDNS
* theBBS.org DynDNS
* DynamIP.com
* Virtual DNS
* SolidDNS
* Nicolas' Internet Services
* RocketDNS
* DNSDyn.com
* DSL Vdns Service
* Tzolkin Corporation
* WebWatchMen

Following are some of DDNS Clients

* DynDNS Updater
* No-IP.com Update Client
* Macintosh Dynamic DNS Client
* DynSite for Windows
* DirectUpdate
* NetCruiser Dynamic Domain
* StaticCling client
* SiteDevelopers.com
* EzDNS IP Address E-mailer/Poster


General How To For Setting Up Dynamic DNS

1. Select a Dyamic DNS Service. As part of the setup, You will need to setup a username/password and a FQDN (Fully Qualified Domain Name) to assign to your computer.

2. Find and install a DDNS client on your computer that is compatible with the Dynamic DNS service.

3. Configure your DDNS client with the name of your DDNS service and the username and password associated with your DDNS service.

4. Start up your DDNS client and test that the DDNS name service is resolving your DDNS name to IP Address correctly. You can either do this by testing the FQDN using a tool such as nslookup, ping.



NOTE: You may also have to configure your cable/dsl modem or firewall to open any ports for the services you want to access remotely.


I hope, this was explanatory .. do pls send your feedbacks and doubts to "manubee4u@yahoo.com", so that I can also improve my KB :-)