Information Gatheringtraceroutenetworkreconnaissancetcpfirewallbypass

InTrace

Traceroute-like application that enumerates IP hops by piggybacking on existing TCP connections. Useful for network reconnaissance and firewall bypassing.

Description

InTrace is a traceroute-like application that enables users to enumerate IP hops exploiting existing TCP connections, both initiated from local network (local system) or from remote hosts. It could be useful for network reconnaissance and firewall bypassing.

The tool works by leveraging established TCP connections rather than sending new probe packets, making it stealthier for reconnaissance purposes. This approach helps discover network paths that might be blocked to standard traceroute tools.

InTrace displays detailed information about each hop including source addresses, ICMP source addresses, and packet types like ICMP_TIMXCEED or NO REPLY, providing visibility into network topology.

How It Works

InTrace piggybacks on existing TCP connections to trace network hops. It sends TCP packets with manipulated TTL values over established connections to remote hosts (like port 80 to www.example.com). Routers along the path return ICMP Time Exceeded (ICMP_TIMXCEED) messages when TTL expires, revealing intermediate hops. The output shows source addresses, ICMP source addresses, and packet types for each hop (1-8 in the example), with payload size, sequence, and acknowledgment numbers tracked.

Installation

bash
sudo apt install intrace

Flags

-hSpecify target hostname
-pSpecify port number
-sSpecify payload size in bytes
-dSet debug level
-4Use IPv4
-6Use IPv6

Examples

Run a trace to www.example.com using port 80 with 4-byte payload, showing 8 hops with ICMP_TIMXCEED responses and some NO REPLY
intrace -h www.example.com -p 80 -s 4
Trace to example.com over HTTPS port 443 using default payload size
intrace -h example.com -p 443
Trace with larger 8-byte payload to increase packet visibility
intrace -h target.com -p 80 -s 8
Enable debug level 1 for additional packet information during trace
intrace -h www.target.com -p 80 -d 1
Force IPv4 tracing to SSH port 22 on target host
intrace -4 -h ipv4host.com -p 22
Force IPv6 tracing to HTTP port 80
intrace -6 -h ipv6host.com -p 80
Basic trace using default payload size to example.com port 80
intrace -h www.example.com -p 80
Updated 2026-04-16kali.org ↗