Hacker News Reader

There should be a traceroute protocol whereby a "specially marked packet" is understood to be traceroute, and generates an ICMP response even though its TTL is still positive. The ICMP response will carry the observed TTL value.

Then one packet will get all the echoes in one go instead of having to send a tirade of packets with increasing TTL values.

View on HN

Combined with IP source address spoofing, it would probably help greatly with DDoS amplification attacks while only saving up <50% packets for good users.

If you care about time rather than packet count, you can send packets with all reasonable TTL values at once.

Oh no question; the amplification is concerning. Send one packet, get 19 responses, versus having to send 19 packets to get 19 responses: it's a "gain" of 19 to 1.

Have enough problems with routers not sending normal ttl expired messages

Just use a better client. Takes about 3 seconds to do an mtr -b over 15 responding hops from a server in London to something like 43.249.179.0 in the south pacific.

Reply on news.ycombinator.com