Tracebox, a middlebox detection tool
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
debian fix Debian build with debuild (#62) Jun 15, 2018
doc Simplify doc generation/packaging May 4, 2015
noinst Added debug flag Oct 19, 2017
src Default IPv4 ID field to a random value Jan 16, 2018
.gitignore Added quick version check, bump libcrafter Oct 9, 2017
.gitmodules add EDO option Apr 3, 2015
.travis.yml Fix Travis accepting failing builds on PR Sep 15, 2017
AUTHORS Updated authors list Jul 19, 2015
LICENSE Add LICENSE file May 7, 2014 build: split bootstrap/configure Mar 11, 2015


Build Status CircleCI

Tracebox is a tool that allows to detect middleboxes on any paths, i.e., between a source and any destination. Tracebox can be viewed as a tool similar to traceroute as it uses ICMP replies to identify changes in the packets. The fact that tracebox is able to detect middleboxes comes from the observation that ICMP messages are often not as defined in RFC792. Indeed it is quite common to receive a ICMP Time-to-Live exceeded message with the original datagram instead of 64 bits as described in the standard. This is caused by operating systems configured to reply with full ICMP (e.g., Linux, Cisco IOS-XR, etc.) as well as the ICMP Multi-Part Messages extension that standardize the fact that routers using MPLS tunnels replies and ICMP message containing the full datagram.


Mac OS X (Using Homebrew)

Yosemite and El Capitan users need to first ensure they installed the full command line developer tools provided by Apple using xcode-select --install

brew install tracebox




apt-get install autotools autoconf automake libtool liblua5.2-dev libpcap-dev libjson0 libjson0-dev libcurl4-gnutls-dev lua-ldoc libnetfilter-queue-dev lua5.2

Fedora (24)

dnf install autoconf automake libtool lua-devel libpcap-devel json-c-devel gnutls-devel lua-ldoc libnetfilter_queue-devel

To build:

$ ./
$ ./configure [--prefix=install_prefix [--enable-tests][--enable-curl]]
$ make
# make install

You can grab the latest build here (source package or *.deb).

We rely on [CircleCI] to generate the build packages, if the above link fails, you can try to retrieve them manually by browsing to the tracebox project build status, selecting the latest build and then downloading the *.deb packages in the Artifacts tab.


The package is available at

Inside the OpenWRT SDK:

$ echo "src-git tracebox git://" >> feeds.conf.default
$ ./scripts/feeds install -a tracebox
$ make menuconfig # select tracebox in "Network"
$ make package/tracebox/compile # should generate a package in bin/<target>/packages/tracebox_*.ipk

This is currently unmaintained.


An Android build script is available at

Your phone will need to be rooted.


Upon installation, see man tracebox and in /usr/local/share/doc/tracebox

The Lua API is (should) be documented and is available at It can be generated using LDoc from the doc directory (see config.ld):

$ ldoc .

The documentation should be created under doc/html

JSON Output Format

More detailled information about the successive hops can be obtained using the -j option, this will as well change the output mode to JSON.

As the output will be buffered, you SHOULD make use of the max hop parameter (-m) if the target node does not answer in order to get the partial trace.

    "addr"     : "IP of the destination",
    "name"     : "Name of the destination [Optional]",
    "max_hops" : "Number of maximum hops",
    "Hops"     : [ /* Array containing each hop information */
            "hop"           : "Corresponding TTL/hop limit",
            "from"          : "IP address of that hop",
            "delay"         : "Delay between the probe and the reply (usec)",
            "name"          : "Name of the hop [Optional]",
            "Modifications" : [
                // if tracebox was called with -v :
                    "Name of the modification" : {
                        "Expected" : "Value injected",
                        "Received" : "Value receveid"
                // else:
                    "Name of the modification"
            "Additions"    : [
                // if tracebox was called with -v :
                        "Name of the modification" : {
                            "Info": "Information added"
                // else:
                    "Name of the field(s) added"
            "Deletions"     : [
                // if tracebox was called with -v :
                        "Name of the modification" : {
                            "Info": "Information deleted"
                // else:
                    "Name of the field(s) deleted"
            "ICMPExtension" : /*[Optional]*/ [
                //if tracebox was called with -v :
                        "Name of the extension" : {
                            "Info": "Information of the extension"
                // else:
                    "Name of the extension(s)"