Backend
Protocol Divergence Localization: Finding WHERE Firewalls Block Your Traffic
Biplab Dev.to (EN Zone)
1 views
The Problem
You're debugging a connectivity issue. ping works fine, but curl times out.
The usual approach:
Run traceroute with ICMP - looks fine
Run traceroute with TCP - dies at hop 6
Manually compare each hop
Finally identify the firewall/ACL
What if you could see this in one command?
Protocol Divergence Localization
I added this feature to multiprobe, a Rust network probing library. It runs ICMP, TCP, and UDP traceroutes simultaneously and identifies where protocols start behaving differently.
$ sudo multiprobe divergence problematic-host.example.com
Protocol Divergence Analysis: problematic-host.example.com (203.0.113.50)
Protocols: ["ICMP", "TCP", "UDP"]
Hop ICMP TCP UDP Status
--- -------------------- -------------------- -------------------- ----------
1 192.168.1.1 (1.23ms) 192.168.1.1 (1.45ms) 192.168.1.1 (1.12ms) ✓
2 10.0.0.1 (5.67ms) 10.0.0.1 (5.89ms) 10.0.0.1 (5.34ms) ✓
3 172.16.0.1 (8.90ms) * (timeout) * (timeout) ⚠ DIVERGE
Summary:
Protocol divergence detected at hop 3. Path score: 0.33
First divergence at hop 3
Reason: ICMP succeeded, TCP/UDP failed
Hop 3 is the culprit. That's 172.16.0.1 - probably a firewall blocking TCP/UDP but allowing ICMP.
How It Works
Parallel Probing: Send ICMP echo, TCP SYN, and UDP packets with increasing TTL values simultaneously
Per-Hop Comparison: At each hop, compare which protocols got responses
Divergence Detection: Calculate an "agreement score" (1.0 = all agree, 0.0 = complete disagreement)
Report: Identify the first hop where protocols start behaving differently
Library Usage
use multiprobe::{analyze_divergence, DivergenceOptions, DivergenceProtocol};
use std::time::Duration;
#[tokio::main]
async fn main() -> Result<(), multiprobe::Error> {
let options = DivergenceOptions {
max_hops: 30,
timeout_per_hop: Duration::from_secs(2),
protocols: vec![
DivergenceProtocol::Icmp,
DivergenceProtocol::Tcp,
DivergenceProtocol::Udp,
],
tcp_port: 80,
udp_port: 33434,
};
let result = analyze_divergence("example.com", &options).await?;
if let Some(hop) = result.first_divergence_hop {
println!("Divergence at hop {}", hop);
} else {
println!("No divergence - all protocols behave consistently");
}
Ok(())
}
Use Cases
Firewall Rule Debugging: Find which hop has a blocking ACL
Middlebox Detection: Identify protocol-specific traffic shaping
ISP Troubleshooting: Pinpoint where the problem is
Network Security Audit: Verify filtering rules are applied where expected
Installation
# CLI tool
cargo install multiprobe
# Library
cargo add multiprobe
Requires elevated privileges (raw sockets) on Linux/macOS.
Links:
crates.io
GitHub
Documentation
Read original: https://dev.to/biplabku/protocol-divergence-localization-finding-where-firewalls-block-your-traffic-514a
← Previous
I’m Building Happening ... A Social App for Discovering What’s Happening Around You
Next →
PicoCTF Mod 26 Writeup — Brute-Force a Caesar Cipher
Related
Don't put getaddrinfo on your proxy's hot path
Backend
0
DEV Community
Dockerizing ROS 2 and AI Robotics Applications for NVIDIA Jetson
Backend
0
Dev.to (EN Zone)
Building a Vision-Language Robot with Jetson + ROS 2
Backend
0
Dev.to (EN Zone)
Edge LLMs on NVIDIA Jetson: Building an AI Assistant for Robots
Backend
0
Dev.to (EN Zone)
Comments0
No comments yet — be the first