LFT — Layer Four Traceroute

3.99WhoB 3.99

• New -B / --tcp-options: send a realistic client TCP option set (MSS, SACK-permitted, timestamps, window scale) on SYN probes so they resemble a real operating system's SYN instead of a bare, option-less one. Firewalls that normalize or scrub TCP may drop option-less SYNs; -B helps LFT traverse them. Default and adaptive TCP engines only; off by default, and it changes only the packets on the wire, not LFT's output.
• TCP, UDP, and ICMP traces no longer count silent near hops (TTL 1-3) toward the early give-up threshold. A stateful firewall or ICMP rate policer at the local edge often suppresses the first few hops even when the path core and the target respond; excluding them lets LFT probe far enough to reach a live hop and complete the trace instead of bailing early. A genuinely dead path still terminates normally.
• whob now honors a target given on the command line even when its standard input is redirected from an empty or closed source (for example `whob host </dev/null`, or when run from a script or cron). Previously a readable-but-empty stdin made whob switch to bulk-input mode and ignore the argv target, producing no output. Piped input (`echo host | whob`) and explicit `-f -` are unaffected.
• Build hardening for the setuid-root binary: compiled with stack-smashing protection, fortified library calls, position-independent execution, and read-only relocations, applied automatically where the toolchain supports them. Negligible runtime cost.
• LFT now aborts if the post-socket setuid() privilege drop fails, rather than continuing with root privileges.
• Fixed a null format argument in a whois "no reply" message and an AS-number buffer that truncated 10-digit AS numbers.
• Fixed -D with an IP address: an inverted interface-lookup check rejected a valid local IP as unknown, and a missing-braces else ran the device-name assignments unconditionally. -D now works with either a device name or a local interface IP (the send device is set in both cases).
• Makefile now lists the shared headers (lft_lib.h, lft_types.h, lft_queue.h, lft_lsrr.h) as dependencies of every object file, so editing a header recompiles all objects. Previously a header-only change could leave stale objects linked with mismatched struct layout.
• Source-port selection reworked for stateful-firewall traversal. One-shot TCP traces now use a distinct source port per hop by default, so each TTL is a separate 5-tuple and a stateful firewall cannot rate-limit the trace as one flow. -s N fixes one source port for every hop, overriding the default and -z. -z uses one consistent random source port for the whole trace (the previous default behavior), keeping all hops on one ECMP path. Watch mode holds the source port constant within each cycle and rotates it between cycles, preserving per-cycle ECMP consistency while presenting a fresh flow each cycle. Per-hop variation is TCP only.
• The watch-mode interval may now be given in the detached form (-W 5 / --watch 5), as the manual page always implied. Previously only -W5 / --watch=5 took effect; the detached value silently became a stray argument and the interval fell back to the 5-second default.
• Watch-mode topology inheritance no longer tightens probe pacing (scatter_ms) in narrowed cycles. The 5 ms clamp quadrupled the send rate once the path was learned, tripping per-source ICMP rate-limit policers on backbone routers and showing 50-73% phantom loss on far hops that measured 0% with --no-learn. Narrowed cycles now keep the standard adaptive pacing; TTL narrowing, pipeline widening, and the adaptive timeout are unchanged.
• Fixed watch-mode ASN/NETNAME/ORGNAME columns showing the first public hop's whois data for every subsequent hop: the shared pWhoIs session's consolidated fields are write-once until reset, and the per-query reset was missing, so the first successful lookup's values were inherited by all later hops. Each hop now gets its own lookup result.
• Watch mode now displays the ASN/NETNAME/ORGNAME columns by default ([w] toggles them off); previously they appeared only when -A or -N was given.
• Fixed TCP watch-mode cycles losing target replies behind stateful middleboxes (CGNAT/pf/conntrack): probe sequence numbers restarted from the session ISN each cycle, so once topology inheritance narrowed the probe count, the target SYN was re-sent with a lower sequence number on the same 4-tuple and middleboxes silently dropped it as out-of-window. The ISN base now advances by the prior cycle's probe count at each reset, keeping sequence numbers monotonic across cycles. The 5-tuple (and thus ECMP path selection) is unchanged; UDP's fixed IP-ID base is unaffected.
• Watch mode path-change detection rebuilt as a proper heuristic. Detection now arms only after the path has been learned (path length stable for 3 cycles, or 8 cycles at most), requires a changed hop to persist for two observed cycles before alerting, and tolerates multipath: a hop alternating among addresses already seen at the same TTL is an "ECMP shift", not a path change. Only confirmed changes flash the status bar; flaps, ECMP shifts (capped at three log lines per hop), and path-length changes are quiet log-drawer entries, each prefixed with its cycle number. A confirmed change resets that hop's multipath memory so a later reversion to the old path alerts as a route restore. Cloaked cycles ('*') neither advance nor cancel a pending change, so reroutes on rate-limited hops still confirm. The 'c' (full clear) key re-enters the learning period.
• Duplicate target-hop lines from ahead-limit overshoot are now suppressed in all probe modes. When -a is large enough, probes at TTLs beyond the target also reach it and each was printed as an additional [target open] (or [replied]) line. The report loop in finish() already guarded this; the same found_target guard is now in tcp_base_finish() (lft_btcptrace.c) and icmp_finish() (lft_icmptrace.c), so only the first target hop line is emitted regardless of protocol.
• Reverse-DNS retry for unresolved hops in watch mode: the per-IP dns_cache now tracks attempts and in-flight state per entry. A PTR lookup that timed out on an early cycle is retried on later cycles (up to 3 attempts total) instead of leaving the hostname blank for the life of the session; IPs that genuinely have no PTR record stop being queried after the cap, preserving the no-redundant-queries behavior of the persistent cache.