Network tool tracetcp now does not work

PeterUK · August 26

USG FLEX 700H V1.39(ABZI.0)ITS-260800953 or V1.39(ABZI.0)ITS-26WK32-m12287

seem there was a big changes in V1.39 such as slower throughput but now this tool does not work
https://simulatedsimian.github.io/tracetcp.html

In either a SNAT or bridge setup but in bridge if you turn off policy control then tracetcp works.

My guess is the firmware now does not expect a ICMP Time-to-live exceeded (Time to live exceeded in transit) reply on a TCP low TTL as it trace routes the hops.

Zyxel_Melen · August 27

Hi @PeterUK

Could it because the policy control causes this issue? I assume your test was a PC/server under the bridge interface and use this tracetcp.exe to trace route. What command did you use to test?

Additionally, our team is checking the throughput issue. I will update on that post when I get further information.

PeterUK · August 27

Hi Melen

Good to hear the throughput issue is being looked into.

No its not policy control causes this issue because in a simple SNAT setup you can turn off policy control and tracetcp will not work because of the SNAT but in bridge when policy control is on you send TCP low TTL as it trace routes the hops but the ICMP Time-to-live exceeded (Time to live exceeded in transit) reply are blocked even if you try to allow them in a WAN to DMZ and the tracetcp then only works if you turn off policy control

this is what I see with policy control on for a DMZ to WAN1 any and WAN1 to DMZ any

tracetcp grc.com:443


Tracing route to 4.79.142.200 [grc.com] on port 443

Over a maximum of 30 hops.

1       *       *       *       Request timed out.

2       *       *       *       Request timed out.

3       *       *       *       Request timed out.

4       *       *       *       Request timed out.

5       *       *       *       Request timed out.

6       *       *       *       Request timed out.

7       *       *       *       Request timed out.

8       Destination Reached in 154 ms. Connection established to 4.79.142.200

Trace Complete.

this is what I see with policy control off

tracetcp grc.com:443


Tracing route to 4.79.142.200 [grc.com] on port 443

Over a maximum of 30 hops.

1       13 ms   6 ms    24 ms   10.112.32.133

2       7 ms    8 ms    19 ms   80.255.196.178  [basl-core-2b-ae63-650.network.virginmedia.net]

3       *       *       *       Request timed out.

4       *       *       *       Request timed out.

5       14 ms   13 ms   39 ms   80.255.204.61   [telw-ic-5-ae0-0.network.virginmedia.net]

6       30 ms   17 ms   15 ms   213.105.23.1    [cur1-stok2-0-0-gw.1-4.cable.virginm.net]

7       *       *       *       Request timed out.

8       Destination Reached in 170 ms. Connection established to 4.79.142.200

Trace Complete.

Zyxel_Melen · August 31

Hi @PeterUK

May I confirm if you mean disable the security policy function, or the specific policies(WAN1 to DMZ any and DMZ to WAN1 any)?

PeterUK · August 31

hi Melen

Iet me see if I can word it more clearer

I make the rules top of the list policies (WAN1 to DMZ any and DMZ to WAN1 any) it simply does not work and that for a bridge only when then whole policy control is off does it work.

if you try by SNAT setup it too simply does not work and if the whole policy control off does not help.

It be simple if you test the issue yourself note that npacp needs winPcap API-compatible mode on install

Network tool tracetcp now does not work

All Replies

Categories

Security Help Center