Event ID - 33434

Port No33434
Service Nametraceroute
RFC Doc0
ProtocolTCP
DescriptionThe Traceroute program uses the next socket subroutines: socket (create sockets), sendto (send message) , recvfrom (receive message), setsockopt (set socket options), select (check I/O status).

The subroutins send and recv are applied only when the socket is connected (TCP). The subroutins sendto and recvfrom allows an application program to send and receive messages through an unconnected socket (UDP, ICMP). For the sendoto a destination address has to be specifyied in the struct sockaddr (or sockaddr_in). The recvfrom returns the source address accosiated with each incoming data in the same structure.

The subroutine socket creates two sockets: for sending and for receiving. For the case of the multithreaded traceroute these sockets are created for every traceroute client. The first parameter of the socket is the Addrees Family. For both sockets this parameter have to be AF_INET. The field sin_family from the struct sockaddr_in have to be AF_INET as well.

The second parameter Socket Type have to be SOCK_RAW. It provides access to internal network protocols and interfaces. This type of socket is available only to the root user.
Reference LinkMore Information
AttackNo

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.