Protocol Divergence Localization: Finding WHERE Firewalls Block Your Traffic

Biplab — Thu, 10 Sep 2026 20:56:39 +0000

The Problem

You're debugging a connectivity issue. ping works fine, but curl times out.

The usual approach:

Run traceroute with ICMP - looks fine
Run traceroute with TCP - dies at hop 6
Manually compare each hop
Finally identify the firewall/ACL

What if you could see this in one command?

Protocol Divergence Localization

I added this feature to multiprobe, a Rust network probing library. It runs ICMP, TCP, and UDP traceroutes simultaneously and identifies where protocols start behaving differently.

$ sudo multiprobe divergence problematic-host.example.com

Protocol Divergence Analysis: problematic-host.example.com (203.0.113.50)
Protocols: ["ICMP", "TCP", "UDP"]

Hop        ICMP                 TCP                  UDP                  Status
--- -------------------- -------------------- -------------------- ----------
  1 192.168.1.1 (1.23ms) 192.168.1.1 (1.45ms) 192.168.1.1 (1.12ms)          ✓
  2 10.0.0.1 (5.67ms)    10.0.0.1 (5.89ms)    10.0.0.1 (5.34ms)             ✓
  3 172.16.0.1 (8.90ms)  * (timeout)          * (timeout)           ⚠ DIVERGE

Summary:
  Protocol divergence detected at hop 3. Path score: 0.33
  First divergence at hop 3
  Reason: ICMP succeeded, TCP/UDP failed

Hop 3 is the culprit. That's 172.16.0.1 - probably a firewall blocking TCP/UDP but allowing ICMP.

How It Works

Parallel Probing: Send ICMP echo, TCP SYN, and UDP packets with increasing TTL values simultaneously
Per-Hop Comparison: At each hop, compare which protocols got responses
Divergence Detection: Calculate an "agreement score" (1.0 = all agree, 0.0 = complete disagreement)
Report: Identify the first hop where protocols start behaving differently

Library Usage

use multiprobe::{analyze_divergence, DivergenceOptions, DivergenceProtocol};
use std::time::Duration;

#[tokio::main]
async fn main() -> Result<(), multiprobe::Error> {
    let options = DivergenceOptions {
        max_hops: 30,
        timeout_per_hop: Duration::from_secs(2),
        protocols: vec![
            DivergenceProtocol::Icmp,
            DivergenceProtocol::Tcp,
            DivergenceProtocol::Udp,
        ],
        tcp_port: 80,
        udp_port: 33434,
    };

    let result = analyze_divergence("example.com", &options).await?;

    if let Some(hop) = result.first_divergence_hop {
        println!("Divergence at hop {}", hop);
    } else {
        println!("No divergence - all protocols behave consistently");
    }

    Ok(())
}

Use Cases

Firewall Rule Debugging: Find which hop has a blocking ACL
Middlebox Detection: Identify protocol-specific traffic shaping
ISP Troubleshooting: Pinpoint where the problem is
Network Security Audit: Verify filtering rules are applied where expected

Installation

# CLI tool
cargo install multiprobe

# Library
cargo add multiprobe

Requires elevated privileges (raw sockets) on Linux/macOS.

Links:

Implementing Paris Traceroute in Rust: Tracing Paths Through Load Balancers

Biplab — Thu, 10 Sep 2026 07:54:19 +0000

Standard traceroute is broken on modern networks.

If you've ever run traceroute to debug a connectivity issue and seen wildly inconsistent hops, you've hit this problem. The culprit: Equal-Cost Multi-Path (ECMP) routing.

The Problem

ECMP load balancers distribute traffic across multiple paths based on flow identifiers — typically a hash of source IP, destination IP, source port, and destination port. Traditional traceroute changes the destination port (or ICMP sequence number) for each probe, which means each probe can take a completely different path through the network.

The result? A traceroute that shows hops from multiple physical paths stitched together into one nonsensical output.

Paris Traceroute

In 2006, Augustin et al. published "Avoiding traceroute anomalies with Paris traceroute" at IMC. The key insight: keep flow identifiers constant across all probes so they all traverse the same path.

For UDP probes, this means:

Same source port
Same destination port
Vary the TTL (and checksum) only

For ICMP, it's trickier — ICMP echo requests don't have ports. Paris Traceroute manipulates the ICMP checksum field to maintain a constant value that ECMP routers hash on.

Implementing in Rust

I couldn't find a pure-Rust implementation, so I built one in multiprobe.

The core concept is a FlowId that stays constant:


rust
pub struct FlowId {
    pub src_port: u16,
    pub dst_port: u16,
    pub identifier: u16,
}

impl FlowId {
    pub fn udp(src: u16, dst: u16) -> Self {
        Self { src_port: src, dst_port: dst, identifier: 0 }
    }
}
When sending probes, we only vary the TTL:


let trace = Probe::paris("example.com")
    .flow_id(FlowId::udp(33434, 33434))
    .max_hops(30)
    .send().await?;

for hop in &trace.hops {
    println!("{:2}. {:15} {:.2}ms", 
        hop.ttl, 
        hop.addr.map(|ip| ip.to_string()).unwrap_or("*".into()),
        hop.rtt.as_secs_f64() * 1000.0);
}
Detecting Load Balancing
Once you can trace a single path consistently, you can also detect load balancing by sending probes with different flow IDs and comparing the paths:


let paths = discover_paths("example.com", 6, &Default::default()).await?;
println!("Found {} distinct paths", paths.len());
If you get multiple distinct paths, you've found an ECMP load balancer.

Results
With Paris Traceroute, you get:

Consistent paths through ECMP networks
Accurate hop-by-hop latency measurements
Load balancer detection (per-flow vs per-packet)
Try It

[dependencies]
multiprobe = "0.1"
crates.io
GitHub
docs.rs
References
Augustin, B., et al. "Avoiding traceroute anomalies with Paris traceroute." IMC 2006.
RFC 1191: Path MTU Discovery
Questions or feedback? Open an issue on GitHub or find me on [platform].

DEV Community: Biplab

Protocol Divergence Localization: Finding WHERE Firewalls Block Your Traffic

The Problem

Protocol Divergence Localization

How It Works

Library Usage

Use Cases

Installation

Implementing Paris Traceroute in Rust: Tracing Paths Through Load Balancers

The Problem

Paris Traceroute

Implementing in Rust