Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to identify which particular router between me and some server blocks connections on certain port?

I am in a hotel in Thailand, where they have recently changed some settings in their equipment, and now I cannot reach any of my servers in Europe and USA by SSH / port 22. More traditional ports like 80 or 21 are open.

traceroute command shows each particular router in the middle. But is there a way to identify one that filters out port 22?

share|improve this question

migrated from stackoverflow.com Jul 4 '12 at 11:13

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 5 down vote accepted

You could probably use tcptraceroute to see where it gets blocked:

$ sudo tcptraceroute ruminant.bitfolk.com 22
Selected device eth0, address 192.168.0.8, port 49071 for outgoing packets
Tracing the path to ruminant.bitfolk.com (85.119.82.121) on TCP port 22 (ssh), 30 hops max
 1  192.168.0.7  0.978 ms  0.556 ms  0.697 ms
 2  192.168.1.1  1.587 ms  1.667 ms  1.681 ms
 3  no-dns-yet-62-3-84-19.zen.co.uk (62.3.84.19)  27.635 ms  26.925 ms  27.658 ms
 4  ge-2-1-0-121.cr2.th-lon.zen.net.uk (62.3.84.213)  28.592 ms  27.971 ms  27.649 ms
 5  linx-gw-a.jump.net.uk (195.66.224.34)  28.614 ms  29.028 ms  63.603 ms
 6  president.bitfolk.com (85.119.80.16)  28.606 ms  28.039 ms  28.657 ms
 7  ruminant.bitfolk.com (85.119.82.121) [open]  28.594 ms  29.030 ms  28.671 ms
share|improve this answer

In addition to the existing answers, you can also use the standard traceroute command with the -P and -p flags. This option requires root privileges.

Actually, while using tcpdump to confirm this, it seems that you actually have to use -T instead of -P tcp. I tried with -P 6 as well but that didn't cause traceroute to use TCP. -M tcp does work.

$ sudo traceroute -T -p 22 79.125.0.4
traceroute to 79.125.0.4 (79.125.0.4), 30 hops max, 60 byte packets
 1  rbx-5-m1.fr.eu (91.121.21.253)  0.708 ms  0.690 ms  0.583 ms
 2  rbx-1-6k.fr.eu (213.251.191.1)  0.951 ms *  0.765 ms
 3  rbx-g1-a9.fr.eu (94.23.122.106)  1.325 ms  1.485 ms  1.047 ms
 4  * * *
 5  195.66.237.175 (195.66.237.175)  5.894 ms  6.812 ms  4.083 ms
 6  178.236.3.57 (178.236.3.57)  16.493 ms  16.813 ms  16.393 ms
 7  178.236.3.155 (178.236.3.155)  16.600 ms  16.479 ms  16.422 ms
 8  178.236.0.75 (178.236.0.75)  16.337 ms  16.384 ms  16.333 ms
 9  178.236.0.58 (178.236.0.58)  17.786 ms  16.171 ms  16.957 ms
10  ec2-79-125-0-4.eu-west-1.compute.amazonaws.com (79.125.0.4)  18.493 ms  18.672 ms  18.244 ms
11  * * *
12  * * *
13  * * *
share|improve this answer

You should use lft in linux or cygwin. lft will traceroute on a specific TCP or UDP port

tee@tee:~$ sudo lft -T 4.2.2.2:22

Tracing _______________________________________________

LFT can't seem to round-trip.  Local packet filter in the way?

TTL  LFT trace to vnsc-bak.sys.gtei.net (4.2.2.2):22/tcp
 1   49.109.61.1 0.4ms
 2   49.109.62.109 0.3ms
**   [neglected] no reply packets received from TTL 3
 4   te0-1-0-7.ccr22.dfw01.atlas.cogentco.com (154.54.0.121) 0.7ms
 5   te0-0-0-0.ccr21.dfw01.atlas.cogentco.com (154.54.46.165) 0.7ms
**   [neglected] no reply packets received from TTL 6
 7   te-3-2.car3.Dallas1.Level3.net (4.68.110.109) 0.9ms
 8   ae-41-90.car1.Dallas1.Level3.net (4.69.145.195) 1.0ms
**   [22/tcp failed]  Try alternate options or use -V to see packets.

LFT's trace took 6.33 seconds.  Resolution required 0.05 seconds.

tee@tee:~$ 
share|improve this answer
    
Normal traceroute can be told to use TCP. –  Ladadadada Jul 4 '12 at 21:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.