Protocol Divergence Localization: Finding WHERE Firewalls Block Your Traffic

#rust #networking #devops #sysadmin

The Problem

You're debugging a connectivity issue. ping works fine, but curl times out.

The usual approach:

Run traceroute with ICMP - looks fine
Run traceroute with TCP - dies at hop 6
Manually compare each hop
Finally identify the firewall/ACL

What if you could see this in one command?

Protocol Divergence Localization

I added this feature to multiprobe, a Rust network probing library. It runs ICMP, TCP, and UDP traceroutes simultaneously and identifies where protocols start behaving differently.

$ sudo multiprobe divergence problematic-host.example.com

Protocol Divergence Analysis: problematic-host.example.com (203.0.113.50)
Protocols: ["ICMP", "TCP", "UDP"]

Hop        ICMP                 TCP                  UDP                  Status
--- -------------------- -------------------- -------------------- ----------
  1 192.168.1.1 (1.23ms) 192.168.1.1 (1.45ms) 192.168.1.1 (1.12ms)          ✓
  2 10.0.0.1 (5.67ms)    10.0.0.1 (5.89ms)    10.0.0.1 (5.34ms)             ✓
  3 172.16.0.1 (8.90ms)  * (timeout)          * (timeout)           ⚠ DIVERGE

Summary:
  Protocol divergence detected at hop 3. Path score: 0.33
  First divergence at hop 3
  Reason: ICMP succeeded, TCP/UDP failed

Hop 3 is the culprit. That's 172.16.0.1 - probably a firewall blocking TCP/UDP but allowing ICMP.

How It Works

Parallel Probing: Send ICMP echo, TCP SYN, and UDP packets with increasing TTL values simultaneously
Per-Hop Comparison: At each hop, compare which protocols got responses
Divergence Detection: Calculate an "agreement score" (1.0 = all agree, 0.0 = complete disagreement)
Report: Identify the first hop where protocols start behaving differently

Library Usage

use multiprobe::{analyze_divergence, DivergenceOptions, DivergenceProtocol};
use std::time::Duration;

#[tokio::main]
async fn main() -> Result<(), multiprobe::Error> {
    let options = DivergenceOptions {
        max_hops: 30,
        timeout_per_hop: Duration::from_secs(2),
        protocols: vec![
            DivergenceProtocol::Icmp,
            DivergenceProtocol::Tcp,
            DivergenceProtocol::Udp,
        ],
        tcp_port: 80,
        udp_port: 33434,
    };

    let result = analyze_divergence("example.com", &options).await?;

    if let Some(hop) = result.first_divergence_hop {
        println!("Divergence at hop {}", hop);
    } else {
        println!("No divergence - all protocols behave consistently");
    }

    Ok(())
}

Use Cases

Firewall Rule Debugging: Find which hop has a blocking ACL
Middlebox Detection: Identify protocol-specific traffic shaping
ISP Troubleshooting: Pinpoint where the problem is
Network Security Audit: Verify filtering rules are applied where expected

Installation

# CLI tool
cargo install multiprobe

# Library
cargo add multiprobe

Requires elevated privileges (raw sockets) on Linux/macOS.

Links:

DEV Community