Traceroute on Sophos XG

Traceroute uses ICMP calls to find the hosts.

https://en.wikipedia.org/wiki/Traceroute

So basically your Client tries to reach every hop via ICMP. If the last station is XG, it seems like XG is blocking your ICMP requests. Do you have a firewall rule to allow this client to use ICMP ? 

I remember on v15 or v16 to have the same issue. Depending on the OS you are performing the tests from.

In my case, Mac OS, traceroute does not work even if I create an ICMP firewall rule at the top.

Here the tcpdump result:

19:20:37.858433 Port1, IN: IP 192.168.0.8.33641 > 8.8.8.8.33435: UDP, length 24
19:20:37.858588 Port1, OUT: IP 192.168.0.1 > 192.168.0.8: ICMP time exceeded in-transit, length 60

19:20:37.865663 Port1, IN: IP 192.168.0.8.33641 > 8.8.8.8.33436: UDP, length 24
19:20:37.865805 Port1, OUT: IP 192.168.0.1 > 192.168.0.8: ICMP time exceeded in-transit, length 60
19:20:37.867118 Port1, IN: IP 192.168.0.8.33641 > 8.8.8.8.33437: UDP, length 24
19:20:37.867249 Port1, OUT: IP 192.168.0.1 > 192.168.0.8: ICMP time exceeded in-transit, length 60
19:20:37.868407 Port1, IN: IP 192.168.0.8.33641 > 8.8.8.8.33438: UDP, length 24

Tried it with Windows, works fine. 

Could you please create a drppkt of those drops? 

And which filter for tcpdump did you use? 

Same here. I hit the XG and from then on *.

I run the same test on W10 out the same firewall rule and success.

Ian

Sent pcap via PM.

Let us know LuCar Toni

Hi, thanks for reply. 

I create one rule permit Info_Address, Info_Request, Ping and IMCP, but ping works correctly and traceroute no. I try from Linux and MacOs computer but the result is the same. 

I have a sensation that is a problem from a bgp process when the networks are published from Sophos, but not are connected directly. 

I have to run new tests. 

Hi folks,

then answer appears to be traceroute -I sophos.com on MACs.

Ian

I would need the drop packet capture, not a Wireshark Dump. 

Lucar,

the tcpdump comes from xg console.

Ian,

can you try from Linux box?

Thanks