networking

TTL (Time To Live) — is an eight-bit field in the IP header that defines the maximum number of “hops” (nodes) a packet can traverse before being discarded. Each time it passes through any router the TTL value is decreased by 1.

Typical default TTL values

Different operating systems use different initial values. This allows remote OS fingerprinting.

Why change TTL? Usage patterns

1. Bypassing tethering restrictions (internet sharing)

The most common scenario. Mobile carriers analyze incoming traffic.

If I were sent to a deserted digital island and allowed to take only one networking utility — I would unhesitatingly choose Netcat.

The official documentation (man nc) dryly states: “a utility for reading from and writing to network connections using TCP or UDP.”
In practice it’s the Swiss army knife of the network engineer, replacing dozens of specialized programs.

The article uses examples for OpenBSD netcat — this is the one that ships by default in Ubuntu 20.04+, Debian 10+, Fedora, Arch, Alpine and most modern distributions.

Read more

Every time you type google.com into your browser, some magic happens. Your computer doesn’t know where that site physically lives. To find out, it asks the DNS (Domain Name System) — a giant distributed database often called “the Internet’s phone book.”

This book consists of records, each of which tells the world something specific about your domain: where your site lives, where to send email, or how to verify that you own the domain.

In a world where data privacy and access to resources are often restricted by geoblocks or corporate policies, tools like ProxyChains become indispensable assistants. ProxyChains — or more precisely its modern fork ProxyChains-NG — is an open utility for Unix-like systems (Linux, macOS, etc.) that allows routing the network traffic of any application through a chain of proxy servers. It is especially popular among developers, pentesters, and security enthusiasts. In this article we’ll cover what ProxyChains can do, why it’s useful for developers, provide usage examples, and discuss its limitations.

Introduction

Up to this point, we’ve used simple utilities for specific tasks:

• ping checked connectivity,
• traceroute showed the path,
• ipconfig and arp helped with the local network,
• telnet and nc tested ports.

That’s like having a separate hammer, screwdriver, and wrench. But sometimes you need a multi-purpose tool. Today we’ll look at three such “all-in-one” tools:

• mtr — ping + traceroute on steroids,
• nmap — universal network scanner,
• curl — a command-line browser.

mtr — Real-Time Traceroute 🚀

What does it do?

Combines the features of ping and traceroute. In real time, it shows latency and packet loss percentage for each hop along the path.

Introduction

A server’s IP address is like the postal address of an apartment building. But to reach the right apartment, you need the door number. In networking, these doors are ports.

• HTTP runs on port 80.
• HTTPS — on port 443.
• Mail, databases, and other services listen on their own ports.

If a port is closed or nothing is listening on it, the site won’t open — even if the server is “alive.”

Introduction

You’ve gone through all the checks from the previous articles:

• The computer has the correct IP address (ipconfig).
• The router responds (ping 192.168.1.1).
• Ping to a public address (ping 8.8.8.8) works.

Looks like the internet is fine! But the browser won’t open google.com. 🤔 Welcome to the most common cause of such issues — DNS failures.

What is DNS? 📖

The internet runs on IP addresses (e.g., 142.250.184.110), but people prefer names (google.com).

Introduction

In the previous article, we learned how to reach out to remote servers using ping and trace the path of packets with traceroute. But what if ping google.com doesn’t work, and traceroute stops right at the first step?

That’s a clear sign that the problem is nearby: on your computer, in the network cable, or in your home router. Before calling tech support, let’s check our own local network.