Macbook: MyTraceRoute an alternative ICMP route tracing which works with Zscaler / Zero Trust architecture

If your on a zero trust network adapter like zscaler or netskope, you will see that traceroute doesn’t work as expected. The article below shows how to install mtr (my trace route) using brew:

## Install xcode
xcode-select --install
## Install mtr
brew install mtr

Next we need to change the owner of the MTR package and it’s permissions (otherwise you will need to run it as root every time):

sudo chown root /opt/homebrew/Cellar/mtr/0.95/sbin/mtr-packet
sudo chmod 4755 /opt/homebrew/Cellar/mtr/0.95/sbin/mtr-packet
## Symlink to the new mtr package instead of the default MAC version
ln -s /opt/homebrew/Cellar/mtr/0.95/sbin/mtr /opt/homebrew/bin/
ln -s /opt/homebrew/Cellar/mtr/0.95/sbin/mtr-packet /opt/homebrew/bin/

To run a rolling traceroute with ICMP echo’s use the following:

Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                       Packets               Pings
 Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev

The issue is that Zscaler will attempt to tunnel this traffic. This can be observed by viewing your current routes:

netstat -rn
Destination        Gateway            Flags           Netif Expire
default          UGScg             en0
1                 UGSc            utun6
2/7               UGSc            utun6
4/6               UGSc            utun6
8/5               UGSc            utun6
10/12             UGSc            utun6         UGHS            utun6         UGHS            utun6
10.1.31/24         UGSc            utun6         UGHS            utun6         UGHS            utun6         UGHS            utun6         UGHS            utun6         UGHS            utun6         UGHS            utun6         UGHS            utun6

As you can see from the above, it lists the routes that are being sent to the Zscaler tunnel interface “utun6” (this is unique to your machine but will look similar). To get around this you can specify the source interface the MTR should run from with the “-I” flag. Below we instruct mtr to use en0 (the lan cable):

mtr -I en0
                                                                                                                                                                                                            Packets               Pings
 Host                                                                                                                                                                                                     Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. unfisecuregateway                                                                                                                                                                                      1.8%    56    2.0   2.2   1.5   4.5   0.6
 2.                                                                                                                                                                                            0.0%    56    4.2   8.1   3.1  28.3   6.0
 3.                                                                                                                                                                                          0.0%    56    4.2   4.5   3.4   8.2   0.9
 4.                                                                                                                                                                                         0.0%    55    3.0   4.0   2.6  18.8   2.4
 5.                                                                                                                                                                                            0.0%    55    5.1   6.3   3.7  12.4   2.0
 6.                                                                                                                                                                                           0.0%    55    4.9   4.1   2.6  12.5   1.5
 7. (waiting for reply)
 8.                                                                                                                                                                                         0.0%    55    4.0   4.8   3.1  13.8   1.8
 9.                                                                                                                                                                                         0.0%    55    4.3   5.3   2.9  37.6   5.2
10.                                                                                                                                                                                         0.0%    55   15.2   4.9   2.9  15.2   2.2
11.                                                                                                                                                                                         0.0%    55    3.4   5.7   3.1  18.9   2.9
12.                                                                                                                                                                                         0.0%    55    4.6   5.5   3.8  11.4   1.3
13. (waiting for reply)

MTR supports TCP, UDP and SCTP based traceroutes. This is useful when testing path latency and packet loss in external or internal networks where QoS is applied to different protocols and ports. Multiple flags are available (man mtr), but for a TCP based MTR use  -T (indicates TCP should be used) and -P (port to trace to):

mtr -T -P 443 -I en0

Ping specifying source interface

Ping supports specifying the source interface you would like to initiate the ping from. The “-S” flag indicates that the following IP is the source IP address the ping should be done from. This is useful if you want to ping using an internal resource bypassing a route manipulator tool such as Zscaler.

ping -S

Leave a Reply

Your email address will not be published. Required fields are marked *