https://github.com/osquery/osquery logo
Title
b

Bacarus

03/09/2021, 2:04 PM
Hello everyone, I need help with this query: given an ip, there is a way to have the route to reach that ip with osquery? (something like the tracert command)
m

Mike Myers

03/09/2021, 4:37 PM
I believe there's only one way to make osquery initiate an outgoing connection to an arbitrary IP address, and that is the
curl
table, but it doesn't do a trace-route. https://osquery.io/schema/4.6.0/#curl
Maybe the
routes
table holds something of value
b

Bacarus

03/09/2021, 5:45 PM
For now I’m using the round_trip_time in the curl schema but I was looking for something different. The Routes schema has the route table for the host system but i’m looking for the entire route used to reach a remote ip address
t

theopolis

03/09/2021, 5:49 PM
I think it’s an interesting feature request, if the code implementation was manageable I think we could support this.
m

Mike Myers

03/09/2021, 6:28 PM
the implementation involves repeatedly sending a packet to the destination with incrementing TTL, right? If you have control over that field from user-mode, it should be easy enough